High severity · published Jul 11, 2018
CVE-2018-8171
A Security Feature Bypass vulnerability exists in ASP.NET when the number of incorrect login attempts is not validated, aka "ASP.NET Security Feature Bypass Vulnerability." This…
7.5
CVSS
10.8%
EPSS
No
On KEV
Description
A Security Feature Bypass vulnerability exists in ASP.NET when the number of incorrect login attempts is not validated, aka "ASP.NET Security Feature Bypass Vulnerability." This affects ASP.NET, ASP.NET Core 1.1, ASP.NET Core 1.0, ASP.NET Core 2.0, ASP.NET MVC 5.2.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)10.8% · higher than 96% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AC
Asp.net Core · Microsoft
1.0; 1.1; 2.0 · source: NVD
AM
Asp.net Model View Controller · Microsoft
5.2 · source: NVD
AW
Asp.net Webpages · Microsoft
3.2.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-8171
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-8171
Third Party Advisory
http://www.securityfocus.com/bid/104659
Third Party Advisory
http://www.securitytracker.com/id/1041267
Patch
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8171
More from Asp.net Core
7.5
CVE-2023-44487
HTTP/2 Rapid Reset Attack Vulnerability
7.5
CVE-2023-38180
.NET and Visual Studio Denial of Service Vulnerability
9.9
CVE-2025-55315
Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an authorized attacker to bypass a security feature over a network
9.4
CVE-2026-88092
ASP.NET Core Tampering Vulnerability
9.1
CVE-2026-40372
ASP.NET Core Elevation of Privilege Vulnerability