An elevation of privilege vulnerability exists when a ASP.NET Core web application, created using vulnerable project templates, fails to properly sanitize web requests, aka 'ASP.NET Core Elevation Of Privilege Vulnerability'.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - An elevation of privilege vulnerability exists when a ASP.NET Core web application, created using
    vulnerable project templates, fails to properly sanitize web requests, aka 'ASP.NET Core Elevation Of
    Privilege Vulnerability'. (CVE-2019-1302)

The Microsoft .NET Core SDK installation on the remote host is version 2.1.x < 2.1.509, or 2.1.606 or 2.1.802, 2.2.x < 2.2.109 or 2.2.206 or 2.2.302.
It is, therefore, affected by multiple vulnerabilities: 

  - A denial of service vulnerability when .Net Core improperly handles     web requests. An unauthenticated, remote attacker     could exploit this issue, to cause a denial of service attack against     a .Net Core web application. (CVE-2019-1301)

  - An elevation of privilege vulnerability that could lead to     a content injection attack enabling an attacker to run a script     in the context of the logged-on user. An unauthenticated, remote attacker     could exploit this issue, via a link that has a specially crafted URL,     and convince the user to click the link. (CVE-2019-1302)

The Microsoft ASP.NET Core installation on the remote host is version 2.1.x < 2.1.2, or 2.2.x < 2.2.1. It is, therefore, affected by an elevation of privilege vulnerability that could lead to a content injection attack enabling an attacker to run a script in the context of the logged-on user. An unauthenticated, remote attacker could exploit this issue, via a link that has a specially crafted URL, and convince the user to click the link. (CVE-2019-1302)

ID	Name	Product	Family	Type	Severity
420641	SCA: security update for Microsoft.AspNetCore.SpaServices (GHSA-xr8f-59pp-rxxh)	Tenable Cloud Security	SCA Checks	Local	high
420641	SCA: security update for Microsoft.AspNetCore.SpaServices (GHSA-xr8f-59pp-rxxh)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
128772	Security Update for .NET Core SDK (Sep 2019)	Nessus	Windows	Local	high
128770	Security Update for Microsoft ASP.NET Core (Sep 2019)	Nessus	Windows	Local	high

Detections

Analytics

CVE-2019-1302

high

Tenable Plugins

high

high

high

high