CVE-2019-1302: Microsoft ASP.NET Core

High severity, CVSS 8.8. EPSS: 4.8% chance of exploitation in the next 30 days.

An elevation of privilege vulnerability exists when a ASP.NET Core web application, created using vulnerable project templates, fails to properly sanitize web requests, aka 'ASP.NET Core Elevation Of Privilege Vulnerability'.

Affected products

• Microsoft ASP.NET Core: version 2.1 only; version 2.2 only; version 3.0 only

Published 2019-09-11. Last modified 2026-06-17.