TI-2018-00728 Aliases CVE-2018-0787 GHSA-365p-96qv-xr7g

Weak password recovery in Microsoft ASP.NET Core

MEDIUM 50CWE-640Published 2018-03-14 · Updated 2024-09-16

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-640.

Summary

ASP.NET Core 1.0. 1.1, and 2.0 allow an elevation of privilege vulnerability due to how web applications that are created from templates validate web requests, aka "ASP.NET Core Elevation Of Privilege Vulnerability".

Why it matters now

EPSS 0.09573 95th percentileScored 2026-11-07

Fix Fixed Microsoft.AspNetCore.HttpOverrides (NuGet): 2.0.2Microsoft.AspNetCore.Server.Kestrel.Core (NuGet): 2.0.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Microsoft	ASP.NET Core	ASP.NET Core 1.0. 1.1, and 2.0	—	No fix listed	CNA
—	Microsoft.AspNetCore.HttpOverrides (NuGet)	2.0.0 to before 2.0.2	2.0.2	Patch available	GHSA-365p-96qv-xr7g
—	Microsoft.AspNetCore.Server.Kestrel.Core (NuGet)	2.0.0 to before 2.0.2	2.0.2	Patch available	GHSA-365p-96qv-xr7g

ASP.NET Core VendorMicrosoft Affected ASP.NET Core 1.0. 1.1, and 2.0 Fixed in — No fix listed CNA
Microsoft.AspNetCore.HttpOverrides (NuGet) Vendor— Affected 2.0.0 to before 2.0.2 Fixed in 2.0.2 Patch available GHSA-365p-96qv-xr7g
Microsoft.AspNetCore.Server.Kestrel.Core (NuGet) Vendor— Affected 2.0.0 to before 2.0.2 Fixed in 2.0.2 Patch available GHSA-365p-96qv-xr7g

CPE configurations NVD · 3

CPE	Versions	Role	Vendor
cpe:2.3:a:microsoft:asp.net_core:1.0:::::::*	1.0	Vulnerable	Microsoft
cpe:2.3:a:microsoft:asp.net_core:1.1:::::::*	1.1	Vulnerable	Microsoft
cpe:2.3:a:microsoft:asp.net_core:2.0:::::::*	2.0	Vulnerable	Microsoft

cpe:2.3:a:microsoft:asp.net_core:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Microsoft
cpe:2.3:a:microsoft:asp.net_core:1.1:*:*:*:*:*:*:* Versions 1.1 Vulnerable ·Microsoft
cpe:2.3:a:microsoft:asp.net_core:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·Microsoft

Remediation

Fix · GHSA-365p-96qv-xr7g Microsoft.AspNetCore.HttpOverrides (NuGet) Fixed in 2.0.2 Advisory →
Fix · GHSA-365p-96qv-xr7g Microsoft.AspNetCore.Server.Kestrel.Core (NuGet) Fixed in 2.0.2 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2018-0787
2026-10-03 Alias added: GHSA-365p-96qv-xr7g

References

Patch 1

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0787

Advisory 3

TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
TI-2023-19596 .NET and Visual Studio Denial of Service Vulnerability KEVCVSS 3.1HIGH 7.5
TI-2025-34970 ASP.NET Security Feature Bypass Vulnerability CVSS 3.1CRITICAL 9.9
TI-2024-14164 .NET Denial of Service Vulnerability CVSS 3.1HIGH 7.5
TI-2023-18092 ASP.NET Core Denial of Service Vulnerability CVSS 3.1HIGH 8.2
TI-2023-18392 ASP.NET Core Security Feature Bypass Vulnerability CVSS 3.1MEDIUM 6.2

See all 40 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences