GitHub Advisoryadvisory · NuGet

GHSA-vhvh-528q-ff3p Security feature bypass vulnerability exists in ASP.NET when the number of incorrect login attempts is not validated

HIGH Published 2018-10-16 Modified 2022-04-26 Official page ↗
Aliases
CVE-2018-8171
Ecosystem
NuGet
Packages
Microsoft.AspNetCore.Identity
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-287
Reviewed
2020-06-16

Affected packages

• NuGet Microsoft.AspNetCore.Identity: >= 1.0.0, < 1.0.6 → fixed in 1.0.6 • NuGet Microsoft.AspNetCore.Identity: >= 1.1.0, < 1.1.6 → fixed in 1.1.6 • NuGet Microsoft.AspNetCore.Identity: >= 2.0.0, < 2.0.4 → fixed in 2.0.4 • NuGet Microsoft.AspNetCore.Identity: >= 2.1.0, < 2.1.2 → fixed in 2.1.2

Description

A Security Feature Bypass vulnerability exists in ASP.NET when the number of incorrect login attempts is not validated, aka "ASP.NET Security Feature Bypass Vulnerability." This affects ASP.NET, ASP.NET Core 1.1, ASP.NET Core 1.0, ASP.NET Core 2.0, ASP.NET MVC 5.2.

Related

Alias · CVE (1)

  • CVE-2018-8171 A Security Feature Bypass vulnerability exists in ASP.NET when the number of incorrect login attempts is not validated, aka "ASP.NET… vulnerability

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References