An update of the dotnet package has been released.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2018:3676 advisory.

    .NET Core is a managed software framework. It implements a subset of the .NET framework APIs and several     new APIs, and it includes a CLR implementation.

    A new version of .NET Core that addresses a security vulnerability is now available. The updated version     is .NET Core 2.1.5.

    Security Fix(es):

    * .NET Core: Arbitrary file and directory creation (CVE-2018-8416)

    For more information, please refer to the upstream docs in the References     section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Windows host has an installation of .NET Core with a version 2.1.x < 2.1.7 or 2.2.x < 2.2.1. It is, therefore, affected by the following vulnerabilities:

  - An information disclosure vulnerability exists in .NET Core.
  An unauthenticated, remote attacker can exploit this to bypass   cross-origin resource sharing (CORS), to disclose potentially   sensitive information. (CVE-2019-0545)

  - A tampering vulnerability exists in .NET Core. An   authenticated, remote attacker can exploit this to write arbitrary   files and directories with limited control of their destinations.
  (CVE-2018-8416)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A tampering vulnerability exists when .NET Core improperly handles specially crafted files, aka .NET Core     Tampering Vulnerability. This affects .NET Core 2.1. (CVE-2018-8416)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Windows host has an installation of .NET Core with a version of 2.1.x. Therefore, the host is affected by a tampering vulnerability which exists when .NET Core improperly handles specially crafted files. An attacker who successfully exploited this vulnerability could write arbitrary files and directories to certain limited locations on a vulnerable system.

ID	Name	Product	Family	Published	Updated	Severity
237067	Photon OS 4.0: Dotnet PHSA-2025-4.0-0804	Nessus	PhotonOS Local Security Checks	5/22/2025	6/13/2025	high
119413	RHEL 7 : .NET Core on Red Hat Enterprise Linux (RHSA-2018:3676)	Nessus	Red Hat Local Security Checks	12/4/2018	11/5/2024	medium
123132	Security Update for .NET Core (January 2019)	Nessus	Windows	3/27/2019	5/19/2026	high
251399	Linux Distros Unpatched Vulnerability : CVE-2018-8416	Nessus	Misc.	8/18/2025	1/30/2026	medium
118979	Security Update for .NET Core (November 2018)	Nessus	Windows	11/16/2018	5/19/2026	medium

Detections

Analytics

Plugins Search

high

medium

high

medium

medium