CVE-2018-8292

{"containers": {"cna": {"affected": [{"product": "PowerShell Core", "vendor": "Microsoft", "versions": [{"status": "affected", "version": "6.0"}]}, {"product": ".NET Core", "vendor": "Microsoft", "versions": [{"status": "affected", "version": "1.0"}, {"status": "affected", "version": "1.1"}, {"status": "affected", "version": "2.1"}]}], "datePublic": "2018-10-09T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "An information disclosure vulnerability exists in .NET Core when authentication information is inadvertently exposed in a redirect, aka \".NET Core Information Disclosure Vulnerability.\" This affects .NET Core 2.1, .NET Core 1.0, .NET Core 1.1, PowerShell Core 6.0."}], "problemTypes": [{"descriptions": [{"description": "Information Disclosure", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-10-12T09:57:01.000Z", "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft"}, "references": [{"name": "RHSA-2018:2902", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2018:2902"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8292"}, {"name": "105548", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/105548"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "secure@microsoft.com", "ID": "CVE-2018-8292", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "PowerShell Core", "version": {"version_data": [{"version_value": "6.0"}]}}, {"product_name": ".NET Core", "version": {"version_data": [{"version_value": "1.0"}, {"version_value": "1.1"}, {"version_value": "2.1"}]}}]}, "vendor_name": "Microsoft"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "An information disclosure vulnerability exists in .NET Core when authentication information is inadvertently exposed in a redirect, aka \".NET Core Information Disclosure Vulnerability.\" This affects .NET Core 2.1, .NET Core 1.0, .NET Core 1.1, PowerShell Core 6.0."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Information Disclosure"}]}]}, "references": {"reference_data": [{"name": "RHSA-2018:2902", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2018:2902"}, {"name": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8292", "refsource": "CONFIRM", "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8292"}, {"name": "105548", "refsource": "BID", "url": "http://www.securityfocus.com/bid/105548"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T06:54:36.373Z"}, "title": "CVE Program Container", "references": [{"name": "RHSA-2018:2902", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "https://access.redhat.com/errata/RHSA-2018:2902"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8292"}, {"name": "105548", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/105548"}]}]}, "cveMetadata": {"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "assignerShortName": "microsoft", "cveId": "CVE-2018-8292", "datePublished": "2018-10-10T13:00:00.000Z", "dateReserved": "2018-03-14T00:00:00.000Z", "dateUpdated": "2024-08-05T06:54:36.373Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "PowerShell Core", "vendor": "Microsoft", "versions": [{"status": "affected", "version": "6.0"}]}, {"product": ".NET Core", "vendor": "Microsoft", "versions": [{"status": "affected", "version": "1.0"}, {"status": "affected", "version": "1.1"}, {"status": "affected", "version": "2.1"}]}], "source": "secure@microsoft.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:asp.net_core:1.0:*:*:*:*:*:*:*", "matchCriteriaId": "0913F82A-985A-401D-89F6-191684A8AB55", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:asp.net_core:1.1:*:*:*:*:*:*:*", "matchCriteriaId": "8256236D-D4F0-4207-B82D-18B0135CEB4E", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:asp.net_core:2.1:*:*:*:*:*:*:*", "matchCriteriaId": "19C3047E-C222-4636-B1B3-722F2C65BC99", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:powershell_core:6.0:*:*:*:*:*:*:*", "matchCriteriaId": "2D6A900C-6173-466A-B54D-683A12F53138", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An information disclosure vulnerability exists in .NET Core when authentication information is inadvertently exposed in a redirect, aka \".NET Core Information Disclosure Vulnerability.\" This affects .NET Core 2.1, .NET Core 1.0, .NET Core 1.1, PowerShell Core 6.0."}, {"lang": "es", "value": "Existe una vulnerabilidad de divulgaci\u00f3n de informaci\u00f3n en .NET Core cuando la informaci\u00f3n de autenticaci\u00f3n se expone de forma inadvertida en una redirecci\u00f3n. Esto tambi\u00e9n se conoce como \".NET Core Information Disclosure Vulnerability\". Esto afecta a .NET Core 2.1, .NET Core 1.0, .NET Core 1.1 y PowerShell Core 6.0."}], "id": "CVE-2018-8292", "lastModified": "2026-06-17T02:04:34.603", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2018-10-10T13:29:01.213", "references": [{"source": "secure@microsoft.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/105548"}, {"source": "secure@microsoft.com", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/errata/RHSA-2018:2902"}, {"source": "secure@microsoft.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8292"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/105548"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/errata/RHSA-2018:2902"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8292"}], "sourceIdentifier": "secure@microsoft.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2018:2902", "cpe": "cpe:/a:redhat:rhel_dotnet:1.0::el7", "package": "rh-dotnetcore10-dotnetcore-0:1.0.13-1.el7", "product_name": ".NET Core on Red Hat Enterprise Linux", "release_date": "2018-10-10T00:00:00Z"}, {"advisory": "RHSA-2018:2902", "cpe": "cpe:/a:redhat:rhel_dotnet:1.0::el7", "package": "rh-dotnetcore11-dotnetcore-0:1.1.10-1.el7", "product_name": ".NET Core on Red Hat Enterprise Linux", "release_date": "2018-10-10T00:00:00Z"}, {"advisory": "RHSA-2018:2902", "cpe": "cpe:/a:redhat:rhel_dotnet:1.1::el7", "package": "rh-dotnetcore10-dotnetcore-0:1.0.13-1.el7", "product_name": ".NET Core on Red Hat Enterprise Linux", "release_date": "2018-10-10T00:00:00Z"}, {"advisory": "RHSA-2018:2902", "cpe": "cpe:/a:redhat:rhel_dotnet:1.1::el7", "package": "rh-dotnetcore11-dotnetcore-0:1.1.10-1.el7", "product_name": ".NET Core on Red Hat Enterprise Linux", "release_date": "2018-10-10T00:00:00Z"}], "bugzilla": {"description": "Core: information disclosure due to authentication information exposed in a redirect", "id": "1636274", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1636274"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.4", "cvss3_scoring_vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "status": "verified"}, "cwe": "CWE-201", "details": ["An information disclosure vulnerability exists in .NET Core when authentication information is inadvertently exposed in a redirect, aka \".NET Core Information Disclosure Vulnerability.\" This affects .NET Core 2.1, .NET Core 1.0, .NET Core 1.1, PowerShell Core 6.0."], "name": "CVE-2018-8292", "package_state": [{"cpe": "cpe:/a:redhat:rhel_dotnet:2.0", "fix_state": "Out of support scope", "package_name": "rh-dotnet20-dotnet", "product_name": ".NET Core 2.0 on Red Hat Enterprise Linux"}, {"cpe": "cpe:/a:redhat:rhel_dotnet:2.1", "fix_state": "Not affected", "package_name": "rh-dotnet21-dotnet", "product_name": ".NET Core 2.1 on Red Hat Enterprise Linux"}], "public_date": "2018-10-09T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2018-8292\nhttps://nvd.nist.gov/vuln/detail/CVE-2018-8292"], "threat_severity": "Moderate"}

{}