Detections
Analytics
Security Update for .NET Core (January 2019)
high Nessus Plugin ID 123132
Language:
Synopsis
The remote Windows host is affected by a .NET Core tampering and information disclosure vulnerabilities.Description
The remote Windows host has an installation of .NET Core with a version 2.1.x < 2.1.7 or 2.2.x < 2.2.1. It is, therefore, affected by the following vulnerabilities:- An information disclosure vulnerability exists in .NET Core.
An unauthenticated, remote attacker can exploit this to bypass cross-origin resource sharing (CORS), to disclose potentially sensitive information. (CVE-2019-0545)
- A tampering vulnerability exists in .NET Core. An authenticated, remote attacker can exploit this to write arbitrary files and directories with limited control of their destinations.
(CVE-2018-8416)
Solution
Refer to vendor documentation.See Also
http://www.nessus.org/u?75ce0f6d
Plugin Details
Severity: High
ID: 123132
File Name: smb_nt_ms19_jan_dotnet_core.nasl
Version: 1.2
Type: local
Agent: windows
Family: Windows
Published: 3/27/2019
Updated: 10/30/2019
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 4.4
CVSS v2
Risk Factor: Medium
Base Score: 5
Temporal Score: 3.7
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N
CVSS Score Source: CVE-2019-0545
CVSS v3
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:microsoft:.net_core
Required KB Items: installed_sw/.NET Core Windows
Exploit Ease: No known exploits are available
Patch Publication Date: 1/8/2018
Vulnerability Publication Date: 1/8/2019
Reference Information
CVE: CVE-2018-8416, CVE-2019-0545