CVE-2017-8700 Cross-origin Resource Sharing bypass in ASP.NET Core

What is CVE-2017-8700?

CVE-2017-8700 is a high-severity vulnerability in Microsoft Corporation ASP.NET Core, published on 15 Nov 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

ASP.NET Core 1.0, 1.1, and 2.0 allow an attacker to bypass Cross-origin Resource Sharing (CORS) configurations and retrieve normally restricted content from a web application, aka "ASP.NET Core Information Disclosure Vulnerability".

Which versions are affected by CVE-2017-8700?

8 open source packages ship an affected version, including Microsoft.AspNetCore.Mvc.Core and Microsoft.AspNetCore.Mvc.Cors. It affects 1 product.

Products include Microsoft Asp.net Core.

How do I fix CVE-2017-8700?

Upgrade Microsoft.AspNetCore.Mvc.Core to a fixed version for your release line: 1.0.6 or 1.1.6.

Is CVE-2017-8700 being exploited?

There is no known exploitation of CVE-2017-8700 in the wild and no public exploit code.

Other vulnerabilities in Microsoft Corporation ASP.NET Core

• CVE-2025-55315 ASP.NET Security Feature Bypass Vulnerability Critical 9.9
• CVE-2026-88092 ASP.NET Core Tampering Vulnerability Critical 9.4
• CVE-2026-40372 ASP.NET Core Elevation of Privilege Vulnerability Critical 9.1
• CVE-2021-43877 ASP.NET Core and Visual Studio Elevation of Privilege Vulnerability High 8.8
• CVE-2020-0603 Remote code execution in ASP.NET Core High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ECHO-06b1-ea74-05f0, GHSA-3rp6-rjw4-cq39.