« Volver al listado

CVE-2018-8171

Estado: ModificadaAlta (7.5)—

A Security Feature Bypass vulnerability exists in ASP.NET when the number of incorrect login attempts is not validated, aka "ASP.NET Security Feature Bypass Vulnerability." This affects ASP.NET, ASP.NET Core 1.1, ASP.NET Core 1.0, ASP.NET Core 2.0, ASP.NET MVC 5.2.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (3)

Microsoft — Asp.net CoreMicrosoft — Asp.net Model View ControllerMicrosoft — Asp.net Webpages

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2018-8171",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "secure@microsoft.com",
      "affectedData": [
        {
          "vendor": "Microsoft",
          "product": "ASP.NET",
          "versions": [
            {
              "status": "affected",
              "version": "Web Pages 3.2.3 on Microsoft Visual Studio 2013 Update 5"
            },
            {
              "status": "affected",
              "version": "Web Pages 3.2.3 on Microsoft Visual Studio 2015 Update 3"
            }
          ]
        },
        {
          "vendor": "Microsoft",
          "product": "ASP.NET Core",
          "versions": [
            {
              "status": "affected",
              "version": "1.0"
            },
            {
              "status": "affected",
              "version": "1.1"
            },
            {
              "status": "affected",
              "version": "2.0"
            }
          ]
        },
        {
          "vendor": "Microsoft",
          "product": "ASP.NET MVC 5.2",
          "versions": [
            {
              "status": "affected",
              "version": "Microsoft Visual Studio 2013 Update 5"
            },
            {
              "status": "affected",
              "version": "Microsoft Visual Studio 2015 Update 3"
            }
          ]
        }
      ]
    }
  ],
  "published": "2018-07-11T00:29:00.320",
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/104659",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://www.securitytracker.com/id/1041267",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "secure@microsoft.com"
    },
    {
      "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8171",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/104659",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id/1041267",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8171",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A Security Feature Bypass vulnerability exists in ASP.NET when the number of incorrect login attempts is not validated, aka \"ASP.NET Security Feature Bypass Vulnerability.\" This affects ASP.NET, ASP.NET Core 1.1, ASP.NET Core 1.0, ASP.NET Core 2.0, ASP.NET MVC 5.2."
    },
    {
      "lang": "es",
      "value": "Existe una vulnerabilidad de omisión de la característica de seguridad en ASP.NET cuando el número de intentos de inicio de sesión incorrectos no se valida. Esto también se conoce como \"ASP.NET Security Feature Bypass Vulnerability\". Esto afecta a ASP.NET, ASP.NET Core 1.1, ASP.NET Core 1.0, ASP.NET Core 2.0 y ASP.NET MVC 5.2."
    }
  ],
  "lastModified": "2026-06-17T02:04:23.840",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microsoft:asp.net_core:1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0913F82A-985A-401D-89F6-191684A8AB55"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:asp.net_core:1.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8256236D-D4F0-4207-B82D-18B0135CEB4E"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:asp.net_core:2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "345222C2-CD5B-4613-9FF3-9D034974D54F"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:asp.net_model_view_controller:5.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "72194690-5B02-4E16-81CE-8447790D67A4"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:asp.net_webpages:3.2.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E601B5A5-E15B-43BD-98D7-20CBF28A55C6"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secure@microsoft.com"
}