GHSA-vhvh-528q-ff3p

Source

https://github.com/advisories/GHSA-vhvh-528q-ff3p

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-vhvh-528q-ff3p/GHSA-vhvh-528q-ff3p.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-vhvh-528q-ff3p

Aliases

CVE-2018-8171

Published

2018-10-16T19:56:50Z

Modified

2023-11-01T04:49:38.497667Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator

Summary

Security feature bypass vulnerability exists in ASP.NET when the number of incorrect login attempts is not validated

Details

A Security Feature Bypass vulnerability exists in ASP.NET when the number of incorrect login attempts is not validated, aka "ASP.NET Security Feature Bypass Vulnerability." This affects ASP.NET, ASP.NET Core 1.1, ASP.NET Core 1.0, ASP.NET Core 2.0, ASP.NET MVC 5.2.

Database specific

{
    "nvd_published_at": "2018-07-11T00:29:00Z",
    "github_reviewed_at": "2020-06-16T21:57:50Z",
    "severity": "HIGH",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-287"
    ]
}

References

Affected packages

NuGet / Microsoft.AspNetCore.Identity

Package

Name: Microsoft.AspNetCore.Identity; View open source insights on deps.dev
Purl: pkg:nuget/Microsoft.AspNetCore.Identity

Affected ranges

Type: ECOSYSTEM
Events: Introduced

1.0.0

Fixed

1.0.6

Affected versions

1.*

1.0.0

1.0.1

1.0.2

1.0.3

1.0.4

1.0.5

Database specific

{
    "last_known_affected_version_range": "<= 1.0.5"
}

NuGet / Microsoft.AspNetCore.Identity

Package

Name: Microsoft.AspNetCore.Identity; View open source insights on deps.dev
Purl: pkg:nuget/Microsoft.AspNetCore.Identity

Affected ranges

Type: ECOSYSTEM
Events: Introduced

1.1.0

Fixed

1.1.6

Affected versions

1.*

1.1.0

1.1.1

1.1.2

1.1.3

1.1.4

1.1.5

Database specific

{
    "last_known_affected_version_range": "<= 1.1.5"
}

NuGet / Microsoft.AspNetCore.Identity

Package

Name: Microsoft.AspNetCore.Identity; View open source insights on deps.dev
Purl: pkg:nuget/Microsoft.AspNetCore.Identity

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.0.0

Fixed

2.0.4

Affected versions

2.*

2.0.0

2.0.1

2.0.2

2.0.3

Database specific

{
    "last_known_affected_version_range": "<= 2.0.3"
}

NuGet / Microsoft.AspNetCore.Identity

Package

Name: Microsoft.AspNetCore.Identity; View open source insights on deps.dev
Purl: pkg:nuget/Microsoft.AspNetCore.Identity

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.1.0

Fixed

2.1.2

Affected versions

2.*

2.1.0

2.1.1

Database specific

{
    "last_known_affected_version_range": "<= 2.1.1"
}