What’s Vulnerable › Vulnerabilities

CVE-2018-8171

• Severity: high (CVSS 7.5 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 10.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-07-11 · updated 2026-06-17
• Weakness: CWE-287

Description

A Security Feature Bypass vulnerability exists in ASP.NET when the number of incorrect login attempts is not validated, aka "ASP.NET Security Feature Bypass Vulnerability." This affects ASP.NET, ASP.NET Core 1.1, ASP.NET Core 1.0, ASP.NET Core 2.0, ASP.NET MVC 5.2.

Affected products

• Microsoft .NET Core: 1.0, 1.1, 2.0
• Microsoft Asp.Net Model View Controller: 5.2
• Microsoft Asp.Net Webpages: 3.2.3
• Microsoft Corporation ASP.NET: Web Pages 3.2.3 on Microsoft Visual Studio 2013 Update 5, Web Pages 3.2.3 on Microsoft Visual Studio 2015 Update 3
• Microsoft .NET Core: 1.0, 1.1, 2.0
• Microsoft ASP.NET MVC 5.2: Microsoft Visual Studio 2013 Update 5, Microsoft Visual Studio 2015 Update 3

References

• http://www.securityfocus.com/bid/104659
• http://www.securitytracker.com/id/1041267
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8171
• http://www.securityfocus.com/bid/104659
• http://www.securitytracker.com/id/1041267
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8171

Get alerted when CVE-2018-8171 or the next vulnerability affects your stack