Microsoft ASP.NET
En bref
- Source
- NVD
- EPSS
- EPSS 10.77 % · centile 96 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- microsoft
- Statut NVD
- Modified
Rechercher sur…
Description
A Security Feature Bypass vulnerability exists in ASP.NET when the number of incorrect login attempts is not validated, aka "ASP.NET Security Feature Bypass Vulnerability." This affects ASP.NET, ASP.NET Core 1.1, ASP.NET Core 1.0, ASP.NET Core 2.0, ASP.NET MVC 5.2.
Faiblesses (CWE)
- CWE-287 — Authentification incorrecte
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.0 | HIGH 7.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 5.0 | AV:N/AC:L/Au:N/C:N/I:P/A:N | NVD · nvd@nist.gov (Primary) |
Avis
- GHSA-vhvh-528q-ff3p — Security feature bypass vulnerability exists in ASP.NET when the number of incorrect login attempts is not validated
Références européennes
- ENISA EUVD · EUVD-2018-0698
- GCVE · GCVE-0-2018-8171
Avis du CERT-FR
- CERTFR-2018-AVI-337 — Multiples vulnérabilités dans Microsoft .Net · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:microsoft:asp.net_core:1.0:*:*:*:*:*:*:*cpe:2.3:a:microsoft:asp.net_core:1.1:*:*:*:*:*:*:*cpe:2.3:a:microsoft:asp.net_core:2.0:*:*:*:*:*:*:*cpe:2.3:a:microsoft:asp.net_model_view_controller:5.2:*:*:*:*:*:*:*cpe:2.3:a:microsoft:asp.net_webpages:3.2.3:*:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| Microsoft · ASP.NET | affected Web Pages 3.2.3 on Microsoft Visual Studio 2013 Update 5 ; affected Web Pages 3.2.3 on Microsoft Visual Studio 2015 Update 3 |
| Microsoft · ASP.NET Core | affected 1.0 ; affected 1.1 ; affected 2.0 |
| Microsoft · ASP.NET MVC 5.2 | affected Microsoft Visual Studio 2013 Update 5 ; affected Microsoft Visual Studio 2015 Update 3 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |