PT-2018-2082 · Microsoft · Powershell Core+1

Published 2018-10-09 · Updated 2021-04-21 · CVE-2018-8292

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions .NET Core versions 1.0 through 2.1 PowerShell Core version 6.0

Description The issue is related to errors in the authentication procedure, which can lead to the disclosure of protected information. This can be exploited by a remote attacker to reveal sensitive data. The vulnerability is associated with the inadvertent exposure of authentication information in a redirect.

Recommendations For .NET Core versions 1.0 through 2.1, update to a version that includes the fix for this issue to prevent information disclosure. For PowerShell Core version 6.0, consider restricting access to sensitive information until a patch is available.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2019-00033

CVE-2018-8292

GHSA-7JGJ-8WVC-JH57

RHSA-2018:2902

Affected Products

Net Core

Powershell Core

References · 8

• https://osv.dev/vulnerability/GHSA-7jgj-8wvc-jh57 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:2902 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-00033 · Security Note
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8292 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-8292 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-8292 · Security Note
• https://github.com/dotnet/announcements/issues/88 · Note
• http://securityfocus.com/bid/105548 · Note