Detections
Analytics
Security Update for Microsoft ASP.NET Core (DoS) (May 2019)
high Nessus Plugin ID 125164
Language:
Synopsis
The Microsoft ASP.NET Core installations on the remote host contain vulnerable packages.Description
The Microsoft ASP.NET Core installation on the remote host is version 2.1.x < 2.1.11, 2.2.x < 2.2.5. It is, therefore, affected by a denial of service (DoS) vulnerability when ASP.NET Core improperly handles web requests. An unauthenticated, remote attacker could exploit this issue, via sending a specially crafted requests to the .NET Core application, to cause the application to stop responding.Solution
Update ASP.NET Core, remove vulnerable packages and refer to vendor advisory.See Also
http://www.nessus.org/u?75f23c84
http://www.nessus.org/u?d238d2f5
Plugin Details
Severity: High
ID: 125164
File Name: smb_nt_ms19_may_aspdotnet_core.nasl
Version: 1.7
Type: local
Agent: windows
Family: Windows
Published: 5/16/2019
Updated: 12/5/2022
Configuration: Enable thorough checks
Supported Sensors: Frictionless Assessment Agent, Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Low
Score: 3.6
CVSS v2
Risk Factor: Medium
Base Score: 5
Temporal Score: 3.7
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P
CVSS Score Source: CVE-2019-0980
CVSS v3
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:microsoft:asp.net_core
Required KB Items: installed_sw/ASP .NET Core Windows
Exploit Ease: No known exploits are available
Patch Publication Date: 5/14/2019
Vulnerability Publication Date: 5/14/2019