CVE-2018-8171
A Security Feature Bypass vulnerability exists in ASP.NET when the number of incorrect login attempts is not validated, aka "ASP.NET Security Feature Bypass Vulnerability." This affects ASP.NET, ASP.NET Core 1.1, ASP.NET Core 1.0, ASP.NET Core 2.0,…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (9.83%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
A Security Feature Bypass vulnerability exists in ASP.NET when the number of incorrect login attempts is not validated, aka "ASP.NET Security Feature Bypass Vulnerability." This affects ASP.NET, ASP.NET Core 1.1, ASP.NET Core 1.0, ASP.NET Core 2.0, ASP.NET MVC 5.2.
- CVSS 3.0
- 7.5 HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- EPSS
- 9.83% probability · 95th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-287
- Affected
- microsoft/asp.net core · microsoft/asp.net model view controller · microsoft/asp.net webpages
- Source
- secure@microsoft.com
References
- http://www.securityfocus.com/bid/104659Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1041267Third Party Advisory, VDB Entry
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8171Patch, Vendor Advisory
- http://www.securityfocus.com/bid/104659Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1041267Third Party Advisory, VDB Entry
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8171Patch, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.