CVE-2018-8171

A Security Feature Bypass vulnerability exists in ASP.NET when the number of incorrect login attempts is not validated, aka "ASP.NET Security Feature Bypass Vulnerability." This affects ASP.NET, ASP.NET Core 1.1, ASP.NET Core 1.0, ASP.NET Core 2.0, ASP.NET MVC 5.2.

Score

CVSS 3.0 7.5 High

Status

Modified - secure@microsoft.com

Published

2018-07-11

Last modified

2024-08-05

Weaknesses

CWE-287

Affected products

• Asp.net (Microsoft)
• Asp.net Core (Microsoft)
• Asp.net Model View Controller (Microsoft)
• Asp.net Mvc 5.2 (Microsoft)
• Asp.net Webpages (Microsoft)

References

• http://www.securityfocus.com/bid/104659
• http://www.securitytracker.com/id/1041267
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8171