Microsoft ASP.NET
At a glance
- Source
- NVD
- EPSS
- EPSS 10.77 % · percentile 96 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- microsoft
- NVD status
- Modified
Description
A Security Feature Bypass vulnerability exists in ASP.NET when the number of incorrect login attempts is not validated, aka "ASP.NET Security Feature Bypass Vulnerability." This affects ASP.NET, ASP.NET Core 1.1, ASP.NET Core 1.0, ASP.NET Core 2.0, ASP.NET MVC 5.2.
Weaknesses (CWE)
- CWE-287 — Improper Authentication
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.0 | HIGH 7.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 5.0 | AV:N/AC:L/Au:N/C:N/I:P/A:N | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-vhvh-528q-ff3p — Security feature bypass vulnerability exists in ASP.NET when the number of incorrect login attempts is not validated
European references
- ENISA EUVD · EUVD-2018-0698
- GCVE · GCVE-0-2018-8171
CERT-FR advisories
- CERTFR-2018-AVI-337 — Multiples vulnérabilités dans Microsoft .Net · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:microsoft:asp.net_core:1.0:*:*:*:*:*:*:*cpe:2.3:a:microsoft:asp.net_core:1.1:*:*:*:*:*:*:*cpe:2.3:a:microsoft:asp.net_core:2.0:*:*:*:*:*:*:*cpe:2.3:a:microsoft:asp.net_model_view_controller:5.2:*:*:*:*:*:*:*cpe:2.3:a:microsoft:asp.net_webpages:3.2.3:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| Microsoft · ASP.NET | affected Web Pages 3.2.3 on Microsoft Visual Studio 2013 Update 5 ; affected Web Pages 3.2.3 on Microsoft Visual Studio 2015 Update 3 |
| Microsoft · ASP.NET Core | affected 1.0 ; affected 1.1 ; affected 2.0 |
| Microsoft · ASP.NET MVC 5.2 | affected Microsoft Visual Studio 2013 Update 5 ; affected Microsoft Visual Studio 2015 Update 3 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |