CVEvulnerability
CVE-2018-8171
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2018-07-11
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 7.5 HIGH — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-287
Description
A Security Feature Bypass vulnerability exists in ASP.NET when the number of incorrect login attempts is not validated, aka "ASP.NET Security Feature Bypass Vulnerability." This affects ASP.NET, ASP.NET Core 1.1, ASP.NET Core 1.0, ASP.NET Core 2.0, ASP.NET MVC 5.2.
Affected configurations
• microsoft asp.net core 1.0
• microsoft asp.net core 1.1
• microsoft asp.net core 2.0
• microsoft asp.net model view controller 5.2
• microsoft asp.net webpages 3.2.3
Related
Weakness · CWE (1)
- CWE-287 Improper Authentication weakness
References
- http://www.securityfocus.com/bid/104659 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1041267 Third Party Advisory, VDB Entry
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8171 Patch, Vendor Advisory
- http://www.securityfocus.com/bid/104659 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1041267 Third Party Advisory, VDB Entry
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8171 Patch, Vendor Advisory