Lucene search

GitHub Advisory DatabaseGHSA-X5QJ-9VMX-7G6G

HistoryMay 14, 2022 - 1:28 a.m.

Improper Input Validation in .Net Framework API's

2022-05-1401:28:01

CWE-20

GitHub Advisory Database

github.com

improper input validation

.net framework

api's

visual studio

url parsing

spoofing vulnerability

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

5.9

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS

0.002

Percentile

59.1%

JSON

A vulnerability exists in certain .Net Framework API’s and Visual Studio in the way they parse URL’s, aka ‘.NET Framework and Visual Studio Spoofing Vulnerability’.

Affected configurations

Vulners

Node

system.private.uriRange4.3.0–4.3.2

microsoftnetcore.appRange2.1.0–2.1.8

microsoftnetcore.appRange2.2.0–2.2.2

VendorProductVersionCPE
*system.private.uri*cpe:2.3:a:*:system.private.uri:*:*:*:*:*:*:*:*
microsoftnetcore.app*cpe:2.3:a:microsoft:netcore.app:*:*:*:*:*:*:*:*