Lucene search

[email protected]CVE-2018-8171

HistoryJul 11, 2018 - 12:29 a.m.

CVE-2018-8171

2018-07-1100:29:00

CWE-287

[email protected]

web.nvd.nist.gov

311

asp.net

security feature bypass

cve-2018-8171

nvd

vulnerability

asp.net core

asp.net mvc

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

7.3 High

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

74.4%

JSON

A Security Feature Bypass vulnerability exists in ASP.NET when the number of incorrect login attempts is not validated, aka “ASP.NET Security Feature Bypass Vulnerability.” This affects ASP.NET, ASP.NET Core 1.1, ASP.NET Core 1.0, ASP.NET Core 2.0, ASP.NET MVC 5.2.

Affected configurations

Vulners

NVD

Node

microsoftasp.net

microsoftasp.net_core

microsoftasp.net_mvc_5.2MatchMicrosoft Visual Studio 2013 Update 5

microsoftasp.net_mvc_5.2MatchMicrosoft Visual Studio 2015 Update 3

VendorProductVersionCPE
microsoftasp\.net*cpe:2.3:a:microsoft:asp\.net:*:*:*:*:*:*:*:*
microsoftasp\.net*cpe:2.3:a:microsoft:asp\.net:*:*:*:*:*:*:*:*
microsoftasp\.net_core*cpe:2.3:a:microsoft:asp\.net_core:*:*:*:*:*:*:*:*
microsoftasp\.net_core*cpe:2.3:a:microsoft:asp\.net_core:*:*:*:*:*:*:*:*
microsoftasp\.net_core*cpe:2.3:a:microsoft:asp\.net_core:*:*:*:*:*:*:*:*
microsoftasp.net_mvc_5.2Microsoft Visual Studio 2013 Update 5cpe:2.3:a:microsoft:asp.net_mvc_5.2:Microsoft Visual Studio 2013 Update 5:*:*:*:*:*:*:*
microsoftasp.net_mvc_5.2Microsoft Visual Studio 2015 Update 3cpe:2.3:a:microsoft:asp.net_mvc_5.2:Microsoft Visual Studio 2015 Update 3:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
microsoft	asp\.net	*	cpe:2.3:a:microsoft:asp\.net::::::::
microsoft	asp\.net	*	cpe:2.3:a:microsoft:asp\.net::::::::
microsoft	asp\.net_core	*	cpe:2.3:a:microsoft:asp\.net_core::::::::
microsoft	asp\.net_core	*	cpe:2.3:a:microsoft:asp\.net_core::::::::
microsoft	asp\.net_core	*	cpe:2.3:a:microsoft:asp\.net_core::::::::
microsoft	asp.net_mvc_5.2	Microsoft Visual Studio 2013 Update 5	cpe:2.3:a:microsoft:asp.net_mvc_5.2:Microsoft Visual Studio 2013 Update 5:::::::*
microsoft	asp.net_mvc_5.2	Microsoft Visual Studio 2015 Update 3	cpe:2.3:a:microsoft:asp.net_mvc_5.2:Microsoft Visual Studio 2015 Update 3:::::::*

CNA Affected

[
  {
    "product": "ASP.NET",
    "vendor": "Microsoft",
    "versions": [
      {
        "status": "affected",
        "version": "Web Pages 3.2.3 on Microsoft Visual Studio 2013 Update 5"
      },
      {
        "status": "affected",
        "version": "Web Pages 3.2.3 on Microsoft Visual Studio 2015 Update 3"
      }
    ]
  },
  {
    "product": "ASP.NET Core",
    "vendor": "Microsoft",
    "versions": [
      {
        "status": "affected",
        "version": "1.0"
      },
      {
        "status": "affected",
        "version": "1.1"
      },
      {
        "status": "affected",
        "version": "2.0"
      }
    ]
  },
  {
    "product": "ASP.NET MVC 5.2",
    "vendor": "Microsoft",
    "versions": [
      {
        "status": "affected",
        "version": "Microsoft Visual Studio 2013 Update 5"
      },
      {
        "status": "affected",
        "version": "Microsoft Visual Studio 2015 Update 3"
      }
    ]
  }
]