A Security Feature Bypass vulnerability exists in ASP.NET when the number of incorrect login attempts is not validated, aka "ASP.NET Security Feature Bypass Vulnerability." This affects ASP.NET, ASP.NET Core 1.1, ASP.NET Core 1.0, ASP.NET Core 2.0, ASP.NET MVC 5.2.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A Security Feature Bypass vulnerability exists in ASP.NET when the number of incorrect login attempts is
    not validated, aka "ASP.NET Security Feature Bypass Vulnerability." This affects ASP.NET, ASP.NET Core
    1.1, ASP.NET Core 1.0, ASP.NET Core 2.0, ASP.NET MVC 5.2. (CVE-2018-8171)

The Microsoft .NET and ASP.NET installations on the remote host are missing a security update. It is, therefore, affected by the following vulnerability :

  - A Security Feature Bypass vulnerability exists in     ASP.NET when the number of incorrect login attempts is     not validated. An attacker who successfully exploited     this vulnerability could try an infinite number of     authentication attempts. The update addresses the     vulnerability by validating the number of incorrect     login attempts. (CVE-2018-8171)

The Microsoft Visual Studio Products are missing security updates. It is, therefore, affected by multiple vulnerabilities :

  - A remote code execution vulnerability exists in Visual     Studio software when the software does not check the     source markup of a file for an unbuilt project. An     attacker who successfully exploited the vulnerability     could run arbitrary code in the context of the current     user. If the current user is logged on with     administrative user rights, an attacker could take     control of the affected system. An attacker could then     install programs; view, change, or delete data; or     create new accounts with full user rights.
    (CVE-2018-8172)

  - A Security Feature Bypass vulnerability exists in     ASP.NET when the number of incorrect login attempts is     not validated. An attacker who successfully exploited     this vulnerability could try an infinite number of     authentication attempts. The update addresses the     vulnerability by validating the number of incorrect     login attempts. (CVE-2018-8171)     
  - A remote code execution vulnerability exists in .NET     software which can lead to exploitation of a user's     machine by allowing attackers to run arbitrary code.
    The update addresses the vulnerability by correcting     how .NET checks the source markup of a file.
    (CVE-2018-8260)   
  - A tampering vulnerability exists in Microsoft Macro     Assembler when code is improperly validated. The     security update addresses the vulnerability asserting     that Microsoft Macro Assembler properly validates     code logic. (CVE-2018-8232)

ID	Name	Product	Family	Severity
422308	SCA: security update for Microsoft.AspNetCore.Identity (GHSA-vhvh-528q-ff3p)	Tenable Cloud Security	SCA Checks	high
422308	SCA: security update for Microsoft.AspNetCore.Identity (GHSA-vhvh-528q-ff3p)	Tenable Self-Hosted Container Security	SCA Checks	high
111070	Security Updates for Microsoft .NET core and ASP.NET (Bypass) (July 2018)	Nessus	Windows : Microsoft Bulletins	high
111042	Security Updates for Microsoft Visual Studio Products (July 2018)	Nessus	Windows : Microsoft Bulletins	high

Detections

Analytics

CVE-2018-8171

high

Tenable Plugins

high

high

high

high