GHSA-vhvh-528q-ff3p
Security feature bypass vulnerability exists in ASP.NET when the number of incorrect login attempts is not validated
At a glance
- Published
- Updated
- CVE
- CVE-2018-8171
- CVSS_V3
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Description
A Security Feature Bypass vulnerability exists in ASP.NET when the number of incorrect login attempts is not validated, aka "ASP.NET Security Feature Bypass Vulnerability." This affects ASP.NET, ASP.NET Core 1.1, ASP.NET Core 1.0, ASP.NET Core 2.0, ASP.NET MVC 5.2.
Affected packages
| Package | Versions |
|---|---|
| NuGet · Microsoft.AspNetCore.Identity | introduced 1.0.0, fixed 1.0.6 |
| NuGet · Microsoft.AspNetCore.Identity | introduced 1.1.0, fixed 1.1.6 |
| NuGet · Microsoft.AspNetCore.Identity | introduced 2.0.0, fixed 2.0.4 |
| NuGet · Microsoft.AspNetCore.Identity | introduced 2.1.0, fixed 2.1.2 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2018-8171 ADVISORY
- https://github.com/advisories/GHSA-vhvh-528q-ff3p ADVISORY
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8171 WEB
- http://www.securityfocus.com/bid/104659 WEB
- http://www.securitytracker.com/id/1041267 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |