Security restrictions bypass in ASP.NET Core MVC and Microsoft .NET Framework - CVE-2018-8356
Published: July 10, 2018 / Updated: July 10, 2018
Vulnerability identifier: #VU13769
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-8356
CWE-ID: CWE-264
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass security restrictions on the target system.
The vulnerability exists due to improper validation of certificates by .NET Framework components. A remote unauthenticated attacker can present expired certificates when challenged and bypass security restrictions to conduct further attacks.
Affected software
ASP.NET Core MVC
Microsoft .NET Framework
Microsoft .NET Framework
How to mitigate CVE-2018-8356
Install updates from vendor's website.