CVE-2018-8292 .NET Core Information Disclosure
Attackers can obtain authentication information via exposed redirects in .NET Core and PowerShell Core, requiring a security patch.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-8292?
CVE-2018-8292 is a high-severity vulnerability in Microsoft .NET Core, published on 10 Oct 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An information disclosure vulnerability exists in .NET Core when authentication information is inadvertently exposed in a redirect, aka ".NET Core Information Disclosure Vulnerability." This affects .NET Core 2.1, .NET Core 1.0, .NET Core 1.1, PowerShell Core 6.0.
Weakness: CWE-200
Which versions are affected by CVE-2018-8292?
2 open source packages ship an affected version, including System.Net.Http. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
System.Net.Http NuGet | All versions | 4.3.4 |
System.Net.Http NuGet | All versions | 4.3.4 |
Linux distribution packages (4)
rh-dotnetcore10-dotnetcore Red Hat:rhel_dotnet:1.0::el7 | All versions | 0:1.0.13-1.el7 |
rh-dotnetcore10-dotnetcore-debuginfo Red Hat:rhel_dotnet:1.0::el7 | All versions | 0:1.0.13-1.el7 |
rh-dotnetcore11-dotnetcore Red Hat:rhel_dotnet:1.1::el7 | All versions | 0:1.1.10-1.el7 |
rh-dotnetcore11-dotnetcore-debuginfo Red Hat:rhel_dotnet:1.1::el7 | All versions | 0:1.1.10-1.el7 |
Products include Microsoft Asp.net Core, Microsoft Powershell Core.
How do I fix CVE-2018-8292?
Upgrade System.Net.Http to 4.3.4 or later.
Is CVE-2018-8292 being exploited?
There is no known exploitation of CVE-2018-8292 in the wild and no public exploit code.
Other vulnerabilities in Microsoft .NET Core
- CVE-2025-55315 ASP.NET Security Feature Bypass Vulnerability
- CVE-2026-88092 ASP.NET Core Tampering Vulnerability
- CVE-2026-40372 ASP.NET Core Elevation of Privilege Vulnerability
- CVE-2021-43877 ASP.NET Core and Visual Studio Elevation of Privilege Vulnerability
- CVE-2020-0603 Remote code execution in ASP.NET Core
Sources
Also known as ECHO-a484-b54c-511d, GHSA-7jgj-8wvc-jh57, RHSA-2018:2902.