CVE-2018-0786

Microsoft .NET Framework 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, .NET Core 1.0 and 2.0, and PowerShell Core 6.0.0 allow a security feature bypass vulnerability due to the way certificates are validated, aka ".NET Security Feature Bypass Vulnerability."

Published: Jan 10, 2018
Updated: May 9, 2024
CVE: CVE-2018-0786
GHSA: GHSA-jc8g-xhw5-6x46
Severity: High
Exploit:

CVSS v3:

Severity: High
Score: 7.5
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CVSS v2:

Severity: Medium
Score: 5
AV:N/AC:L/Au:N/C:N/I:P/A:N

CWEs:

CWE-295

OWASP TOP 10:

A3 - Sensitive Data Exposure

Affected Software
References

Software	From	Fixed in
microsoft / .net_core	2.0	2.0.x
microsoft / .net_core	1.0	1.0.x
microsoft / powershell_core	6.0	6.0.x
microsoft / .net_framework	2.0-sp2	2.0-sp2.x
microsoft / .net_framework	3.0-sp2	3.0-sp2.x
microsoft / .net_framework	3.5	3.5.x
microsoft / .net_framework	3.5.1	3.5.1.x
microsoft / .net_framework	4.5.2	4.5.2.x
microsoft / .net_framework	4.6	4.6.x
microsoft / .net_framework	4.6.1	4.6.1.x
microsoft / .net_framework	4.6.2	4.6.2.x
microsoft / .net_framework	4.7	4.7.x
microsoft / .net_framework	4.7.1	4.7.1.x
Microsoft.NETCore.UniversalWindowsPlatform	5.2.0	5.2.4
Microsoft.NETCore.UniversalWindowsPlatform	5.3.0	5.3.5
Microsoft.NETCore.UniversalWindowsPlatform	5.4.0	5.4.2
Microsoft.NETCore.UniversalWindowsPlatform	6.0.0	6.0.6
System.ServiceModel.Primitives	4.4.0	4.4.0.x
System.ServiceModel.Primitives	4.4.0	4.4.1
System.ServiceModel.Primitives	4.3.0	4.3.0.x
System.ServiceModel.Primitives	4.3.0	4.3.1
System.ServiceModel.Primitives	4.1.0	4.1.0.x
System.ServiceModel.Primitives	4.1.0	4.1.1
System.ServiceModel.Http	4.4.0	4.4.0.x
System.ServiceModel.Http	4.4.0	4.4.1
System.ServiceModel.Http	4.3.0	4.3.0.x
System.ServiceModel.Http	4.3.0	4.3.1
System.ServiceModel.Http	4.1.0	4.1.0.x
System.ServiceModel.Http	4.1.0	4.1.1
System.ServiceModel.NetTcp	4.4.0	4.4.0.x
System.ServiceModel.NetTcp	4.4.0	4.4.1
System.ServiceModel.NetTcp	4.3.0	4.3.0.x
System.ServiceModel.NetTcp	4.3.0	4.3.1
System.ServiceModel.NetTcp	4.1.0	4.1.0.x
System.ServiceModel.NetTcp	4.1.0	4.1.1
System.ServiceModel.Duplex	4.4.0	4.4.0.x
System.ServiceModel.Duplex	4.4.0	4.4.1
System.ServiceModel.Duplex	4.3.0	4.3.0.x
System.ServiceModel.Duplex	4.3.0	4.3.1
System.ServiceModel.Duplex	4.0.1	4.0.1.x
System.ServiceModel.Duplex	4.0.1	4.0.2
System.ServiceModel.Security	4.4.0	4.4.0.x
System.ServiceModel.Security	4.4.0	4.4.1
System.ServiceModel.Security	4.3.0	4.3.0.x
System.ServiceModel.Security	4.3.0	4.3.1
System.ServiceModel.Security	4.0.1	4.0.1.x
System.ServiceModel.Security	4.0.1	4.0.2
System.Private.ServiceModel	4.4.0	4.4.0.x
System.Private.ServiceModel	4.4.0	4.4.1
System.Private.ServiceModel	4.3.0	4.3.0.x
System.Private.ServiceModel	4.3.0	4.3.1
System.Private.ServiceModel	4.1.0	4.1.0.x
System.Private.ServiceModel	4.1.0	4.1.1

Vulnerability Database

CVE-2018-0786