Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

ASP.NET Core Apps Using Old Templates May Let Hackers Steal Admin Access

CVE-2019-1302 · published 7 years ago
Summary

Some ASP.NET Core web applications created with old project templates are vulnerable to a security issue that could allow an attacker to gain admin access. This is because the applications don't properly filter out bad input from users. To protect your app, update your project templates to the latest version or manually apply the necessary security fixes.

What to do
  • Update microsoft microsoft.aspnetcore.spaservices to version 2.2.7.
  • Update microsoft microsoft.aspnetcore.spaservices to version 2.1.13.
Affected software
Ecosystem VendorProductAffected versions
nuget microsoft microsoft.aspnetcore.spaservices >= 2.2.0, < 2.2.7
>= 2.1.0, < 2.1.13
Fix: upgrade to 2.2.7
– microsoft asp.net_core 2.1
2.2
3.0
cpe:2.3:a:microsoft:asp.net_core:2.1:*:*:*:*:*:*:*
Original advisory text
An elevation of privilege vulnerability exists when a ASP.NET Core web application, created using vulnerable project templates, fails to properly sanitize web requests, aka 'ASP.NET Core Elevation ...
An elevation of privilege vulnerability exists when a ASP.NET Core web application, created using vulnerable project templates, fails to properly sanitize web requests, aka 'ASP.NET Core Elevation Of Privilege Vulnerability'.
References
Severity
8.8 High
Exploitation
5% chance of attack within 30 days
Type
CWE-20Improper Input Validation
Timeline
Published11 Sep 2019
Updated25 Oct 2026
First seen6 Mar 2026
Sources
GHSA-xr8f-59pp-rxxh · GHSA
CVE-2019-1302 · NVD
Track software like this
Free during beta