TI-2019-01018 Aliases CVE-2019-1302 GHSA-xr8f-59pp-rxxh

Improper input validation in Microsoft ASP.NET Core

MEDIUM 46CWE-20Published 2019-09-11 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

An elevation of privilege vulnerability exists when a ASP.NET Core web application, created using vulnerable project templates, fails to properly sanitize web requests, aka 'ASP.NET Core Elevation Of Privilege Vulnerability'.

Why it matters now

EPSS 0.04846 92nd percentileScored 2026-11-07

Fix Fixed Microsoft.AspNetCore.SpaServices (NuGet): 2.2.7, 2.1.13

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Microsoft	ASP.NET Core	2.1; 2.2; 3.0	—	No fix listed	CNA
—	Microsoft.AspNetCore.SpaServices (NuGet)	2.2.0 to before 2.2.7	2.2.7	Patch available	GHSA-xr8f-59pp-rxxh
—	Microsoft.AspNetCore.SpaServices (NuGet)	2.1.0 to before 2.1.13	2.1.13	Patch available	GHSA-xr8f-59pp-rxxh

ASP.NET Core VendorMicrosoft Affected 2.1; 2.2; 3.0 Fixed in — No fix listed CNA
Microsoft.AspNetCore.SpaServices (NuGet) Vendor— Affected 2.2.0 to before 2.2.7 Fixed in 2.2.7 Patch available GHSA-xr8f-59pp-rxxh
Microsoft.AspNetCore.SpaServices (NuGet) Vendor— Affected 2.1.0 to before 2.1.13 Fixed in 2.1.13 Patch available GHSA-xr8f-59pp-rxxh

CPE configurations NVD · 3

CPE	Versions	Role	Vendor
cpe:2.3:a:microsoft:asp.net_core:2.1:::::::*	2.1	Vulnerable	Microsoft
cpe:2.3:a:microsoft:asp.net_core:2.2:::::::*	2.2	Vulnerable	Microsoft
cpe:2.3:a:microsoft:asp.net_core:3.0:::::::*	3.0	Vulnerable	Microsoft

cpe:2.3:a:microsoft:asp.net_core:2.1:*:*:*:*:*:*:* Versions 2.1 Vulnerable ·Microsoft
cpe:2.3:a:microsoft:asp.net_core:2.2:*:*:*:*:*:*:* Versions 2.2 Vulnerable ·Microsoft
cpe:2.3:a:microsoft:asp.net_core:3.0:*:*:*:*:*:*:* Versions 3.0 Vulnerable ·Microsoft

Remediation

Fix · GHSA-xr8f-59pp-rxxh Microsoft.AspNetCore.SpaServices (NuGet) Fixed in 2.2.7 Advisory →
Fix · GHSA-xr8f-59pp-rxxh Microsoft.AspNetCore.SpaServices (NuGet) Fixed in 2.1.13 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2019-1302
2026-10-03 Alias added: GHSA-xr8f-59pp-rxxh

References

Patch 1

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1302

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2019-1302

Other 2

TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
TI-2023-19596 .NET and Visual Studio Denial of Service Vulnerability KEVCVSS 3.1HIGH 7.5
TI-2025-34970 ASP.NET Security Feature Bypass Vulnerability CVSS 3.1CRITICAL 9.9
TI-2024-14164 .NET Denial of Service Vulnerability CVSS 3.1HIGH 7.5
TI-2023-18092 ASP.NET Core Denial of Service Vulnerability CVSS 3.1HIGH 8.2
TI-2023-18392 ASP.NET Core Security Feature Bypass Vulnerability CVSS 3.1MEDIUM 6.2

See all 40 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences