Read the docs
TI-2019-00338 Aliases CVE-2019-0545GHSA-2xjx-v99w-gqf3

Information disclosure in Microsoft .NET Core

Priority MEDIUM 45CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-200.

Summary

An information disclosure vulnerability exists in .NET Framework and .NET Core which allows bypassing Cross-origin Resource Sharing (CORS) configurations, aka ".NET Framework Information Disclosure Vulnerability." This affects Microsoft .NET Framework 2.0, Microsoft .NET Framework 3.0, Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2, Microsoft .NET Framework 4.5.2, Microsoft .NET Framework 4.6, Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2, Microsoft .NET Framework 4.7/4.7.1/4.7.2, .NET Core 2.1, Microsoft .NET Framework 4.7.1/4.7.2, Microsoft .NET Framework 3.5, Microsoft .NET Framework 3.5.1, Microsoft .NET Framework 4.6/4.6.1/4.6.2, .NET Core 2.2, Microsoft .NET Framework 4.7.2.

Why it matters now

EPSS 0.09611 95th percentileScored 2026-11-07
Fix Fixed Microsoft.NETCore.App (NuGet): 2.1.7, 2.2.1Red Hat: 1 advisory

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Microsoft.NET Core2.1; 2.2—No fix listedCNA
MicrosoftMicrosoft .NET Framework2.0 Service Pack 2 on Windows Server 2008 for 32-bit Systems Service Pack 2; 2.0 Service Pack 2 on Windows Server 2008 for Itanium-Based Systems Service Pack 2; 2.0 Service Pack 2 on Windows Server 2008 for x64-based Systems Service Pack 2; 3.0 Service Pack 2 on Windows Server 2008 for 32-bit Systems Service Pack 2; 3.0 Service Pack 2 on Windows Server 2008 for Itanium-Based Systems Service Pack 2; 3.0 Service Pack 2 on Windows Server 2008 for x64-based Systems Service Pack 2; 3.5 on Windows 10 for 32-bit Systems; 3.5 on Windows 10 for x64-based Systems; 3.5 on Windows 10 Version 1607 for 32-bit Systems; 3.5 on Windows 10 Version 1607 for x64-based Systems; 3.5 on Windows 10 Version 1703 for 32-bit Systems; 3.5 on Windows 10 Version 1703 for x64-based Systems; 3.5 on Windows 10 Version 1709 for 32-bit Systems; 3.5 on Windows 10 Version 1709 for ARM64-based Systems; 3.5 on Windows 10 Version 1709 for x64-based Systems; 3.5 on Windows 10 Version 1803 for 32-bit Systems; 3.5 on Windows 10 Version 1803 for ARM64-based Systems; 3.5 on Windows 10 Version 1803 for x64-based Systems; 3.5 on Windows 10 Version 1809 for 32-bit Systems; 3.5 on Windows 10 Version 1809 for x64-based Systems; 3.5 on Windows 8.1 for 32-bit systems; 3.5 on Windows 8.1 for x64-based systems; 3.5 on Windows Server 2012; 3.5 on Windows Server 2012 (Server Core installation); 3.5 on Windows Server 2012 R2; 3.5 on Windows Server 2012 R2 (Server Core installation); 3.5 on Windows Server 2016; 3.5 on Windows Server 2016 (Server Core installation); 3.5 on Windows Server 2019; 3.5 on Windows Server 2019 (Server Core installation); 3.5 on Windows Server, version 1709 (Server Core Installation); 3.5 on Windows Server, version 1803 (Server Core Installation); 3.5.1 on Windows 7 for 32-bit Systems Service Pack 1; 3.5.1 on Windows 7 for x64-based Systems Service Pack 1; 3.5.1 on Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1; 3.5.1 on Windows Server 2008 R2 for x64-based Systems Service Pack 1; 3.5.1 on Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation); 4.5.2 on Windows 7 for 32-bit Systems Service Pack 1; 4.5.2 on Windows 7 for x64-based Systems Service Pack 1; 4.5.2 on Windows 8.1 for 32-bit systems; 4.5.2 on Windows 8.1 for x64-based systems; 4.5.2 on Windows RT 8.1; 4.5.2 on Windows Server 2008 for 32-bit Systems Service Pack 2; 4.5.2 on Windows Server 2008 for x64-based Systems Service Pack 2; 4.5.2 on Windows Server 2008 R2 for x64-based Systems Service Pack 1; 4.5.2 on Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation); 4.5.2 on Windows Server 2012; 4.5.2 on Windows Server 2012 (Server Core installation); 4.5.2 on Windows Server 2012 R2; 4.5.2 on Windows Server 2012 R2 (Server Core installation); 4.6 on Windows Server 2008 for 32-bit Systems Service Pack 2; 4.6 on Windows Server 2008 for x64-based Systems Service Pack 2; 4.6.2/4.7/4.7.1/4.7.2 on Windows 10 Version 1607 for 32-bit Systems; 4.6.2/4.7/4.7.1/4.7.2 on Windows 10 Version 1607 for x64-based Systems; 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2016; 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2016 (Server Core installation); 4.6/4.6.1/4.6.2 on Windows 10 for 32-bit Systems; 4.6/4.6.1/4.6.2 on Windows 10 for x64-based Systems; 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2 on Windows 7 for 32-bit Systems Service Pack 1; 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2 on Windows 7 for x64-based Systems Service Pack 1; 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2 on Windows 8.1 for 32-bit systems; 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2 on Windows 8.1 for x64-based systems; 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2 on Windows RT 8.1; 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2008 R2 for x64-based Systems Service Pack 1; 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation); 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2012; 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2012 (Server Core installation); 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2012 R2; 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2012 R2 (Server Core installation); 4.7.1/4.7.2 on Windows 10 Version 1709 for 32-bit Systems; 4.7.1/4.7.2 on Windows 10 Version 1709 for ARM64-based Systems; 4.7.1/4.7.2 on Windows 10 Version 1709 for x64-based Systems; 4.7.1/4.7.2 on Windows Server, version 1709 (Server Core Installation); 4.7.2 on Windows 10 Version 1803 for 32-bit Systems; 4.7.2 on Windows 10 Version 1803 for ARM64-based Systems; 4.7.2 on Windows 10 Version 1803 for x64-based Systems; 4.7.2 on Windows 10 Version 1809 for 32-bit Systems; 4.7.2 on Windows 10 Version 1809 for x64-based Systems; 4.7.2 on Windows Server 2019; 4.7.2 on Windows Server 2019 (Server Core installation); 4.7.2 on Windows Server, version 1803 (Server Core Installation); 4.7/4.7.1/4.7.2 on Windows 10 Version 1703 for 32-bit Systems; 4.7/4.7.1/4.7.2 on Windows 10 Version 1703 for x64-based Systems—No fix listedCNA
—Microsoft.NETCore.App (NuGet)2.1.0 to before 2.1.72.1.7Patch availableGHSA-2xjx-v99w-gqf3
—Microsoft.NETCore.App (NuGet)2.2.0 to before 2.2.12.2.1Patch availableGHSA-2xjx-v99w-gqf3
  • .NET Core VendorMicrosoft Affected 2.1; 2.2 Fixed in — No fix listed CNA
  • Microsoft .NET Framework VendorMicrosoft Affected 2.0 Service Pack 2 on Windows Server 2008 for 32-bit Systems Service Pack 2; 2.0 Service Pack 2 on Windows Server 2008 for Itanium-Based Systems Service Pack 2; 2.0 Service Pack 2 on Windows Server 2008 for x64-based Systems Service Pack 2; 3.0 Service Pack 2 on Windows Server 2008 for 32-bit Systems Service Pack 2; 3.0 Service Pack 2 on Windows Server 2008 for Itanium-Based Systems Service Pack 2; 3.0 Service Pack 2 on Windows Server 2008 for x64-based Systems Service Pack 2; 3.5 on Windows 10 for 32-bit Systems; 3.5 on Windows 10 for x64-based Systems; 3.5 on Windows 10 Version 1607 for 32-bit Systems; 3.5 on Windows 10 Version 1607 for x64-based Systems; 3.5 on Windows 10 Version 1703 for 32-bit Systems; 3.5 on Windows 10 Version 1703 for x64-based Systems; 3.5 on Windows 10 Version 1709 for 32-bit Systems; 3.5 on Windows 10 Version 1709 for ARM64-based Systems; 3.5 on Windows 10 Version 1709 for x64-based Systems; 3.5 on Windows 10 Version 1803 for 32-bit Systems; 3.5 on Windows 10 Version 1803 for ARM64-based Systems; 3.5 on Windows 10 Version 1803 for x64-based Systems; 3.5 on Windows 10 Version 1809 for 32-bit Systems; 3.5 on Windows 10 Version 1809 for x64-based Systems; 3.5 on Windows 8.1 for 32-bit systems; 3.5 on Windows 8.1 for x64-based systems; 3.5 on Windows Server 2012; 3.5 on Windows Server 2012 (Server Core installation); 3.5 on Windows Server 2012 R2; 3.5 on Windows Server 2012 R2 (Server Core installation); 3.5 on Windows Server 2016; 3.5 on Windows Server 2016 (Server Core installation); 3.5 on Windows Server 2019; 3.5 on Windows Server 2019 (Server Core installation); 3.5 on Windows Server, version 1709 (Server Core Installation); 3.5 on Windows Server, version 1803 (Server Core Installation); 3.5.1 on Windows 7 for 32-bit Systems Service Pack 1; 3.5.1 on Windows 7 for x64-based Systems Service Pack 1; 3.5.1 on Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1; 3.5.1 on Windows Server 2008 R2 for x64-based Systems Service Pack 1; 3.5.1 on Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation); 4.5.2 on Windows 7 for 32-bit Systems Service Pack 1; 4.5.2 on Windows 7 for x64-based Systems Service Pack 1; 4.5.2 on Windows 8.1 for 32-bit systems; 4.5.2 on Windows 8.1 for x64-based systems; 4.5.2 on Windows RT 8.1; 4.5.2 on Windows Server 2008 for 32-bit Systems Service Pack 2; 4.5.2 on Windows Server 2008 for x64-based Systems Service Pack 2; 4.5.2 on Windows Server 2008 R2 for x64-based Systems Service Pack 1; 4.5.2 on Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation); 4.5.2 on Windows Server 2012; 4.5.2 on Windows Server 2012 (Server Core installation); 4.5.2 on Windows Server 2012 R2; 4.5.2 on Windows Server 2012 R2 (Server Core installation); 4.6 on Windows Server 2008 for 32-bit Systems Service Pack 2; 4.6 on Windows Server 2008 for x64-based Systems Service Pack 2; 4.6.2/4.7/4.7.1/4.7.2 on Windows 10 Version 1607 for 32-bit Systems; 4.6.2/4.7/4.7.1/4.7.2 on Windows 10 Version 1607 for x64-based Systems; 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2016; 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2016 (Server Core installation); 4.6/4.6.1/4.6.2 on Windows 10 for 32-bit Systems; 4.6/4.6.1/4.6.2 on Windows 10 for x64-based Systems; 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2 on Windows 7 for 32-bit Systems Service Pack 1; 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2 on Windows 7 for x64-based Systems Service Pack 1; 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2 on Windows 8.1 for 32-bit systems; 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2 on Windows 8.1 for x64-based systems; 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2 on Windows RT 8.1; 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2008 R2 for x64-based Systems Service Pack 1; 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation); 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2012; 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2012 (Server Core installation); 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2012 R2; 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2012 R2 (Server Core installation); 4.7.1/4.7.2 on Windows 10 Version 1709 for 32-bit Systems; 4.7.1/4.7.2 on Windows 10 Version 1709 for ARM64-based Systems; 4.7.1/4.7.2 on Windows 10 Version 1709 for x64-based Systems; 4.7.1/4.7.2 on Windows Server, version 1709 (Server Core Installation); 4.7.2 on Windows 10 Version 1803 for 32-bit Systems; 4.7.2 on Windows 10 Version 1803 for ARM64-based Systems; 4.7.2 on Windows 10 Version 1803 for x64-based Systems; 4.7.2 on Windows 10 Version 1809 for 32-bit Systems; 4.7.2 on Windows 10 Version 1809 for x64-based Systems; 4.7.2 on Windows Server 2019; 4.7.2 on Windows Server 2019 (Server Core installation); 4.7.2 on Windows Server, version 1803 (Server Core Installation); 4.7/4.7.1/4.7.2 on Windows 10 Version 1703 for 32-bit Systems; 4.7/4.7.1/4.7.2 on Windows 10 Version 1703 for x64-based Systems Fixed in — No fix listed CNA
  • Microsoft.NETCore.App (NuGet) Vendor— Affected 2.1.0 to before 2.1.7 Fixed in 2.1.7 Patch available GHSA-2xjx-v99w-gqf3
  • Microsoft.NETCore.App (NuGet) Vendor— Affected 2.2.0 to before 2.2.1 Fixed in 2.2.1 Patch available GHSA-2xjx-v99w-gqf3

CPE configurations NVD · 33

CPEVersionsRoleVendor
cpe:2.3:a:microsoft:.net_framework:2.0:sp2:*:*:*:*:*:*2.0 sp2VulnerableMicrosoft
cpe:2.3:a:microsoft:.net_framework:3.0:sp2:*:*:*:*:*:*3.0 sp2VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*not specified by NVDRunning onMicrosoft
cpe:2.3:a:microsoft:.net_framework:3.5:*:*:*:*:*:*:*3.5VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*not specified by NVDRunning onMicrosoft
cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*1607Running onMicrosoft
cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:*1703Running onMicrosoft
cpe:2.3:o:microsoft:windows_10:1709:*:*:*:*:*:*:*1709Running onMicrosoft
cpe:2.3:o:microsoft:windows_10:1803:*:*:*:*:*:*:*1803Running onMicrosoft
cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:*:*1809Running onMicrosoft
  • cpe:2.3:a:microsoft:.net_framework:2.0:sp2:*:*:*:*:*:* Versions 2.0 sp2 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:.net_framework:3.0:sp2:*:*:*:*:*:* Versions 3.0 sp2 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
  • cpe:2.3:a:microsoft:.net_framework:3.5:*:*:*:*:*:*:* Versions 3.5 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
  • cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:* Versions 1607 Running on ·Microsoft
  • cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:* Versions 1703 Running on ·Microsoft
  • cpe:2.3:o:microsoft:windows_10:1709:*:*:*:*:*:*:* Versions 1709 Running on ·Microsoft
  • cpe:2.3:o:microsoft:windows_10:1803:*:*:*:*:*:*:* Versions 1803 Running on ·Microsoft
  • cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:*:* Versions 1809 Running on ·Microsoft
Show 23 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*all versionsRunning onMicrosoft
cpe:2.3:o:microsoft:windows_server_2012:*:*:*:*:*:*:*:*all versionsRunning onMicrosoft
cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*r2Running onMicrosoft
cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*all versionsRunning onMicrosoft
cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*not specified by NVDRunning onMicrosoft
cpe:2.3:a:microsoft:.net_framework:3.5.1:*:*:*:*:*:*:*3.5.1VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*not specified by NVDRunning onMicrosoft
cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:itanium:*r2 sp1Running onMicrosoft
cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*r2 sp1Running onMicrosoft
cpe:2.3:a:microsoft:.net_framework:4.5.2:*:*:*:*:*:*:*4.5.2VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*not specified by NVDRunning onMicrosoft
cpe:2.3:a:microsoft:.net_framework:4.6.2:*:*:*:*:*:*:*4.6.2VulnerableMicrosoft
cpe:2.3:a:microsoft:.net_framework:4.7:*:*:*:*:*:*:*4.7VulnerableMicrosoft
cpe:2.3:a:microsoft:.net_framework:4.7.1:*:*:*:*:*:*:*4.7.1VulnerableMicrosoft
cpe:2.3:a:microsoft:.net_framework:4.7.2:*:*:*:*:*:*:*4.7.2VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*not specified by NVDRunning onMicrosoft
cpe:2.3:a:microsoft:.net_framework:4.6:*:*:*:*:*:*:*4.6VulnerableMicrosoft
cpe:2.3:a:microsoft:.net_framework:4.6.1:*:*:*:*:*:*:*4.6.1VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*r2 sp1Running onMicrosoft
cpe:2.3:o:microsoft:windows_server:1709:*:*:*:*:*:*:*1709Running onMicrosoft
cpe:2.3:o:microsoft:windows_server:1803:*:*:*:*:*:*:*1803Running onMicrosoft
cpe:2.3:a:microsoft:.net_core:2.1:*:*:*:*:*:*:*2.1VulnerableMicrosoft
cpe:2.3:a:microsoft:.net_core:2.2:*:*:*:*:*:*:*2.2VulnerableMicrosoft
  • cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:* Versions all versions Running on ·Microsoft
  • cpe:2.3:o:microsoft:windows_server_2012:*:*:*:*:*:*:*:* Versions all versions Running on ·Microsoft
  • cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:* Versions r2 Running on ·Microsoft
  • cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:* Versions all versions Running on ·Microsoft
  • cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
  • cpe:2.3:a:microsoft:.net_framework:3.5.1:*:*:*:*:*:*:* Versions 3.5.1 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
  • cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:itanium:* Versions r2 sp1 Running on ·Microsoft
  • cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:* Versions r2 sp1 Running on ·Microsoft
  • cpe:2.3:a:microsoft:.net_framework:4.5.2:*:*:*:*:*:*:* Versions 4.5.2 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
  • cpe:2.3:a:microsoft:.net_framework:4.6.2:*:*:*:*:*:*:* Versions 4.6.2 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:.net_framework:4.7:*:*:*:*:*:*:* Versions 4.7 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:.net_framework:4.7.1:*:*:*:*:*:*:* Versions 4.7.1 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:.net_framework:4.7.2:*:*:*:*:*:*:* Versions 4.7.2 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
  • cpe:2.3:a:microsoft:.net_framework:4.6:*:*:*:*:*:*:* Versions 4.6 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:.net_framework:4.6.1:*:*:*:*:*:*:* Versions 4.6.1 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:* Versions r2 sp1 Running on ·Microsoft
  • cpe:2.3:o:microsoft:windows_server:1709:*:*:*:*:*:*:* Versions 1709 Running on ·Microsoft
  • cpe:2.3:o:microsoft:windows_server:1803:*:*:*:*:*:*:* Versions 1803 Running on ·Microsoft
  • cpe:2.3:a:microsoft:.net_core:2.1:*:*:*:*:*:*:* Versions 2.1 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:.net_core:2.2:*:*:*:*:*:*:* Versions 2.2 Vulnerable ·Microsoft

Remediation

  • Fix · GHSA-2xjx-v99w-gqf3 Microsoft.NETCore.App (NuGet) Fixed in 2.1.7 Advisory →
  • Fix · GHSA-2xjx-v99w-gqf3 Microsoft.NETCore.App (NuGet) Fixed in 2.2.1 Advisory →

Red Hat 1 advisory

  • RHSA-2019:0040 Released 2019-01-09 · Red Hat rating Moderate
    .NET Core on Red Hat Enterprise Linux security update
    • .NET Core on Red Hat Enterprise Linux ComputeNode (v. 7) rh-dotnet21-2.1-6.el7, rh-dotnet21-dotnet-2.1.503-1.el7, rh-dotnet21-dotnet-host-2.1.7-1.el7 +12
    • .NET Core on Red Hat Enterprise Linux Server (v. 7) rh-dotnet21-2.1-6.el7, rh-dotnet21-dotnet-2.1.503-1.el7, rh-dotnet21-dotnet-host-2.1.7-1.el7 +12
    • .NET Core on Red Hat Enterprise Linux Workstation (v. 7) rh-dotnet21-2.1-6.el7, rh-dotnet21-dotnet-2.1.503-1.el7, rh-dotnet21-dotnet-host-2.1.7-1.el7 +12

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
.NET Core on Red Hat Enterprise Linux ComputeNode (v. 7)Fixed RHSA-2019:0040
.NET Core on Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2019:0040
.NET Core on Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2019:0040
Not affected: 3 products
  • .NET Core 1.0 on Red Hat Enterprise Linux
  • .NET Core 1.1 on Red Hat Enterprise Linux
  • Red Hat Enterprise Linux 8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-0545
  2. 2026-10-03 Alias added: GHSA-2xjx-v99w-gqf3

References

Patch 1

Advisory 2

Other 1

  • TI-2020-01112 A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and… KEVCVSS 3.1HIGH 7.8
  • TI-2021-08380 .NET Core Remote Code Execution Vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2020-00583 Improper input validation in Microsoft .NET Core CVSS 3.1HIGH 8.8
  • TI-2020-00582 Improper input validation in Microsoft .NET Core CVSS 3.1HIGH 8.8
  • TI-2021-06407 .NET Core Remote Code Execution Vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2022-11690 .NET and Visual Studio Denial of Service Vulnerability CVSS 3.1HIGH 7.5
See all 31 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences