CVE-2018-0875: microsoft corporation .net core
CVSS: 7.5v3.0HighModified
AliasesRHSA-2018:0522GHSA-xcvr-qv8h-m7xw
Published 14-03-2018Last modified 16-09-2024
Vulnerability summary
CVE-2018-0875 is a high (CVSS 7.5) vulnerability in microsoft corporation .net core. EPSS estimates a 9.08% chance of exploitation in the next 30 days, higher than 95.2% of scored vulnerabilities.
CVSS score
7.5/10
010
High · v3.0 (NVD)EPSS score
9.08%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 14-03-2018PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
.NET Core 1.0, .NET Core 1.1, NET Core 2.0 and PowerShell Core 6.0.0 allow a denial of Service vulnerability due to how specially crafted requests are handled, aka ".NET Core Denial of Service Vulnerability".
CVSS metrics
4 scores · 3 sources · 2 versionsHigh 7.5Preferred score · NVD (NIST)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSources3 sources · 3.7–7.5
- OSV · Red hatEcosystem advisory · calculated3.7LowCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:LDiffers
- OSV · NugetEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Medium 5.0Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:N/I:N/A:PSourcesSingle source
EPSS trend
Probability
9.08%
Chance of exploitation in the next 30 days
Percentile
95%
Versus all other CVEs
30-day change
0.00 pp
From 9.08% on 18-09-2026
18-09-202618-10-2026
EPSS score9.08%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Redhat9 products
- rh-dotnet20-dotnet< 0:2.0.6-1.el7
- rh-dotnet20-dotnet-debuginfo< 0:2.0.6-1.el7
- rh-dotnet20-dotnet-host< 0:2.0.6-1.el7
- rh-dotnet20-dotnet-runtime-2.0< 0:2.0.6-1.el7
- rh-dotnet20-dotnet-sdk-2.1< 0:2.1.101-1.el7
Microsoft2 products
- asp.net_core1.0 | 1.1 | 2.0
- powershell_core6.0
Microsoft corporation1 product
- .net core.NET Core 1.0, .NET Core 1.1, NET Core 2.0 and PowerShell Core 6.0.0 allow a denial of Service vulnerability due to how specially crafted requests are handled, aka ".NET Core Denial of Service Vulnerability".
NuGet1 product
- Microsoft.NETCore.Jit≥ 2.0.0, < 2.0.6 | ≥ 1.1.0, < 1.1.7 | < 1.0.12
4 vendors · 13 products
References
11 links
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0875X Refsource CONFIRMPatchVendor AdvisoryWEB- access.redhat.com/errata/RHSA-2018:0522Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisoryWEB
