Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-mrpr-pw4n-bfae
Vulnerability ID VCID-mrpr-pw4n-bfae
Aliases CVE-2017-0249
GHSA-qhqf-ghgh-x2m4
Summary Improper Input Validation An elevation of privilege vulnerability exists when the ASP.NET Core fails to properly sanitize web requests.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-20 Improper Input Validation
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.05786 https://api.first.org/data/v1/epss?cve=CVE-2017-0249
epss 0.05786 https://api.first.org/data/v1/epss?cve=CVE-2017-0249
epss 0.05786 https://api.first.org/data/v1/epss?cve=CVE-2017-0249
epss 0.05786 https://api.first.org/data/v1/epss?cve=CVE-2017-0249
epss 0.05786 https://api.first.org/data/v1/epss?cve=CVE-2017-0249
epss 0.05786 https://api.first.org/data/v1/epss?cve=CVE-2017-0249
epss 0.05786 https://api.first.org/data/v1/epss?cve=CVE-2017-0249
epss 0.05786 https://api.first.org/data/v1/epss?cve=CVE-2017-0249
epss 0.05786 https://api.first.org/data/v1/epss?cve=CVE-2017-0249
epss 0.05786 https://api.first.org/data/v1/epss?cve=CVE-2017-0249
epss 0.05786 https://api.first.org/data/v1/epss?cve=CVE-2017-0249
epss 0.05786 https://api.first.org/data/v1/epss?cve=CVE-2017-0249
cvssv3.1 7.3 https://github.com/advisories/GHSA-qhqf-ghgh-x2m4
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-qhqf-ghgh-x2m4
generic_textual HIGH https://github.com/advisories/GHSA-qhqf-ghgh-x2m4
cvssv3.1 7.3 https://github.com/Aiko-IT-Systems/DisCatSharp/security/advisories/GHSA-wj4j-gr3f-cfh7
generic_textual HIGH https://github.com/Aiko-IT-Systems/DisCatSharp/security/advisories/GHSA-wj4j-gr3f-cfh7
cvssv3.1 7.3 https://github.com/aspnet/Announcements/issues/239
generic_textual HIGH https://github.com/aspnet/Announcements/issues/239
cvssv3.1 7.3 https://nvd.nist.gov/vuln/detail/CVE-2017-0249
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2017-0249
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2017-0249
https://github.com/aspnet/Announcements/issues/239
CVE-2017-0249 https://nvd.nist.gov/vuln/detail/CVE-2017-0249
GHSA-qhqf-ghgh-x2m4 https://github.com/advisories/GHSA-qhqf-ghgh-x2m4
GHSA-wj4j-gr3f-cfh7 https://github.com/Aiko-IT-Systems/DisCatSharp/security/advisories/GHSA-wj4j-gr3f-cfh7
No exploits are available.
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L Found at https://github.com/advisories/GHSA-qhqf-ghgh-x2m4
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L Found at https://github.com/Aiko-IT-Systems/DisCatSharp/security/advisories/GHSA-wj4j-gr3f-cfh7
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L Found at https://github.com/aspnet/Announcements/issues/239
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L Found at https://nvd.nist.gov/vuln/detail/CVE-2017-0249
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.90455
EPSS Score 0.05786
Published At April 1, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T12:47:14.080846+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/nuget/Microsoft.AspNet.Mvc/CVE-2017-0249.yml 38.0.0