CVE-2019-1302

An elevation of privilege vulnerability exists when a ASP.NET Core web application, created using vulnerable project templates, fails to properly sanitize web requests, aka 'ASP.NET Core Elevation Of Privilege Vulnerability'.

Published: Sep 12, 2019
Updated: May 9, 2024
CVE: CVE-2019-1302
GHSA: GHSA-xr8f-59pp-rxxh
Severity: High
Exploit:

CVSS v3:

Severity: High
Score: 8.8
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS v2:

Severity: Medium
Score: 6.8
AV:N/AC:M/Au:N/C:P/I:P/A:P

CWEs:

CWE-20

Affected Software
References

Software	From	Fixed in
microsoft / asp.net_core	2.1	2.1.x
microsoft / asp.net_core	2.2	2.2.x
microsoft / asp.net_core	3.0	3.0.x
Microsoft.AspNetCore.SpaServices	2.2.0	2.2.7
Microsoft.AspNetCore.SpaServices	2.1.0	2.1.13

https://github.com/aspnet/Announcements/issues/384
https://github.com/github/advisory-database/issues/302
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1302

Vulnerability Database

289,599

CVE-2019-1302