CVE-2017-0247: microsoft corporation asp.net core Improper Input Validation

CVSS: 7.5v3.0HighModified

AliasesGHSA-6xh7-4v2w-36q6

Published 12-05-2017Last modified 05-08-2024

Vulnerability summary

CVE-2017-0247 is a high (CVSS 7.5) Improper Input Validation vulnerability in microsoft corporation asp.net core. EPSS estimates a 16.91% chance of exploitation in the next 30 days, higher than 97% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk

43/100

0100

Medium · default modelHow is this calculated?

CVSS score

7.5/10

010

High · v3.0 (NVD)

EPSS score

16.91%

0%100%

Medium · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits1reference

Timeline

12-05-2017
PublishedVulnerability first disclosed.
05-08-2024
Last modifiedVulnerability information updated.

Description

A denial of service vulnerability exists when the ASP.NET Core fails to properly validate web requests. NOTE: Microsoft has not commented on third-party claims that the issue is that the TextEncoder.EncodeCore function in the System.Text.Encodings.Web package in ASP.NET Core Mvc before 1.0.4 and 1.1.x before 1.1.3 allows remote attackers to cause a denial of service by leveraging failure to properly calculate the length of 4-byte characters in the Unicode Non-Character range.

CVSS metrics

3 scores · 2 sources · 2 versions

v3.07.5v2.05.0

EPSS trend

Probability

16.91%

Chance of exploitation in the next 30 days

Percentile

97%

Versus all other CVEs

30-day change

0.00 pp

From 16.91% on 19-09-2026

19-09-202619-10-2026

EPSS score

16.91%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found

referenceUnverified
Exploit Reference (sidertia.com)
Maturity: unknown

Weaknesses

CWE · root cause

CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Affected systems

NuGet19 products

Microsoft.AspNetCore.Mvc≥ 1.0.0, < 1.0.4 | ≥ 1.1.0, < 1.1.3
Microsoft.AspNetCore.Mvc.Abstractions≥ 1.0.0, < 1.0.4 | ≥ 1.1.0, < 1.1.3
Microsoft.AspNetCore.Mvc.ApiExplorer≥ 1.0.0, < 1.0.4 | ≥ 1.1.0, < 1.1.3
Microsoft.AspNetCore.Mvc.Core≥ 1.0.0, < 1.0.4 | ≥ 1.1.0, < 1.1.3
Microsoft.AspNetCore.Mvc.Cors≥ 1.0.0, < 1.0.4 | ≥ 1.1.0, < 1.1.3

Show all 19

Microsoft18 products

asp.net_model_view_controller1.0.0 | 1.0.1 | 1.0.2 | 1.0.3 | 1.1.0 | 1.1.1 | 1.1.2
microsoft.aspnetcore.mvc.abstractions1.0.0 | 1.0.1 | 1.0.2 | 1.0.3 | 1.1.0 | 1.1.1 | 1.1.2
microsoft.aspnetcore.mvc.apiexplorer1.0.0 | 1.0.1 | 1.0.2 | 1.0.3 | 1.1.0 | 1.1.1 | 1.1.2
microsoft.aspnetcore.mvc.cors1.0.0 | 1.0.1 | 1.0.2 | 1.0.3 | 1.1.0 | 1.1.1 | 1.1.2
microsoft.aspnetcore.mvc.dataannotations1.0.0 | 1.0.1 | 1.0.2 | 1.0.3 | 1.1.0 | 1.1.1 | 1.1.2