Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

NuGet package

hangfire.core

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.6NuGetPublished

    Missing Authorization with Default Settings in Dashboard UI

    CVE-2021-41238 · GHSA-7rq6-7gv8-c37h

    Affected
    • NuGet hangfire.core >= 1.7.25, <= 1.7.25
    Fixed in
    1.7.26· Vendor fix available
    Issue
    Dashboard UI in Hangfire.Core uses authorization filters to protect it from showing sensitive data to unauthorized users. By default when no custom authorization filters specified, LocalRequestsOnlyAuthorizationFilter filter is being used to allow only local requests and prohibit all the remote requests to provide sensible, protected by default settings. However due to the recent changes, in version 1.7.25 no authorization filters are used by default, allowing remote requests to succeed. Impact Missing authorization when default options are used for the Dashboard UI, e.g. when no custom authorization rules are used as recommended in the Using Dashboard documentation article. Impacted If you are using UseHangfireDashboard method with default DashboardOptions.Authorization property value, then your installation is impacted: Not Impacted If any other authorization filter is specified in the DashboardOptions.Authorization property, the you are not impacted: Patches Patch is already…

    Recommended action: Upgrade to 1.7.26 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →