« Volver al listado

CVE-2018-8409

Estado: ModificadaAlta (7.5)—

A denial of service vulnerability exists when System.IO.Pipelines improperly handles requests, aka "System.IO.Pipelines Denial of Service." This affects .NET Core 2.1, System.IO.Pipelines, ASP.NET Core 2.1.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (3)

Microsoft — .net CoreMicrosoft — Asp.net CoreMicrosoft — System.io.pipelines

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2018-8409",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "secure@microsoft.com",
      "affectedData": [
        {
          "vendor": "Microsoft",
          "product": "System.IO.Pipelines",
          "versions": [
            {
              "status": "affected",
              "version": "System.IO.Pipelines"
            }
          ]
        },
        {
          "vendor": "Microsoft",
          "product": ".NET Core",
          "versions": [
            {
              "status": "affected",
              "version": "2.1"
            }
          ]
        },
        {
          "vendor": "Microsoft",
          "product": "ASP.NET Core",
          "versions": [
            {
              "status": "affected",
              "version": "2.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2018-09-13T00:29:02.037",
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/105223",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "secure@microsoft.com"
    },
    {
      "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8409",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/105223",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8409",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A denial of service vulnerability exists when System.IO.Pipelines improperly handles requests, aka \"System.IO.Pipelines Denial of Service.\" This affects .NET Core 2.1, System.IO.Pipelines, ASP.NET Core 2.1."
    },
    {
      "lang": "es",
      "value": "Existe una vulnerabilidad de denegación de servicio (DoS) cuando System.IO.Pipelines gestiona incorrectamente las peticiones. Esto también se conoce como \"System.IO.Pipelines Denial of Service\". Esto afecta a .NET Core 2.1, System.IO.Pipelines y ASP.NET Core 2.1."
    }
  ],
  "lastModified": "2026-06-17T02:04:48.210",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microsoft:.net_core:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "71E5B645-6640-4137-A614-50EBC197147B",
              "versionEndExcluding": "2.1.4",
              "versionStartIncluding": "2.1"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:asp.net_core:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B7A74034-D194-49D3-B9D6-4C368CFD3522",
              "versionEndExcluding": "2.1.4",
              "versionStartIncluding": "2.1"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:system.io.pipelines:4.5.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BFC1EF01-8027-4899-B7AF-C399AF3BD8B3"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secure@microsoft.com"
}