CVE-2017-11879
HighSummary
ASP.NET Core 2.0 allows an attacker to steal log-in session information such as cookies or authentication tokens via a specially crafted URL.
Risk Assessment
This vulnerability may lead to unauthorized access to user accounts, posing a serious threat to data security within the organization.
Recommendation
It is recommended to upgrade to the latest version of ASP.NET Core to mitigate the risks associated with this vulnerability.
Other vulnerabilities in ASP.NET Core 2.0
See all- CVE-2017-0249High
An elevation of privilege vulnerability exists when ASP.NET Core fails to properly sanitize web requests.
- CVE-2026-40372Critical
A vulnerability in ASP.NET Core due to improper verification of cryptographic signature allows an unauthorized attacker to elevate privileges over a network.
- CVE-2020-1161High
Denial of service vulnerability in ASP.NET Core when improperly handling web requests. A remote unauthenticated attacker could send specially crafted requests, causing the application to become unavailable.
- CVE-2026-47303High
ASP.NET Core has an authentication bypass vulnerability due to assumed-immutable data. This allows an authorized attacker to elevate privileges over a network.
- CVE-2026-47300High
Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
- CVE-2026-56170High
Resource allocation without limits in ASP.NET Core allows an unauthorized attacker to perform a DoS attack over the network.
- CVE-2026-50506High
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
- CVE-2026-45646High
A vulnerability in ASP.NET Core allows an unauthorized attacker to perform a Denial of Service (DoS) attack by allocating resources without limits or throttling. The attack can be carried out remotely over a network.
- CVE-2026-45591High
In ASP.NET Core, uncontrolled resource consumption allows an unauthorized attacker to perform a denial of service attack over a network.
- CVE-2026-42899High
A vulnerability in ASP.NET Core causes an infinite loop, which can be exploited by an unauthorized attacker to perform a Denial of Service (DoS) attack over the network.
Original NVD description (English source)
ASP.NET Core 2.0 allows an attacker to steal log-in session information such as cookies or authentication tokens via a specially crafted URL aka "ASP.NET Core Elevation Of Privilege Vulnerability".