CVE-2018-8292

moderate-risk
Published 2018-10-10

An information disclosure vulnerability exists in .NET Core when authentication information is inadvertently exposed in a redirect, aka ".NET Core Information Disclosure Vulnerability." This affects .NET Core 2.1, .NET Core 1.0, .NET Core 1.1, PowerShell Core 6.0.

Do I need to act?

~
6.8% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.5/10 High
NETWORK / LOW complexity

Affected Products (4)

Affected Vendors

Microsoft

References (6)

Third Party Advisory http://www.securityfocus.com/bid/105548
Third Party Advisory https://access.redhat.com/errata/RHSA-2018:2902
Patch https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8292
Third Party Advisory http://www.securityfocus.com/bid/105548
Third Party Advisory https://access.redhat.com/errata/RHSA-2018:2902
Patch https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8292
45
/ 100
moderate-risk
Severity 26/34 · High
Exploitability 9/34 · Low
Exposure 10/34 · Low