An information disclosure vulnerability exists in .NET Core when authentication information is inadvertently exposed in a redirect, aka ".NE

Summary

An information disclosure vulnerability exists in .NET Core when authentication information is inadvertently exposed in a redirect, aka ".NET Core Information Disclosure Vulnerability." This affects .NET Core 2.1, .NET Core 1.0, .NET Core 1.1, PowerShell Core 6.0.

Timeline

1. Oct 10, 2018, 1:00 PM UTCCVE published
2. Aug 5, 2024, 6:54 AM UTCRecord last updated
3. Oct 28, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• Microsoft PowerShell Core

  6.0

• Microsoft .NET Core

  1.0, 1.1, 2.1

• System.Net.HttpNuGet

  fixed in 4.3.4

References 3