CVE-2018-8171 (High) detected in microsoft.aspnet.webpages.3.2.3.nupkg, microsoft.aspnet.mvc.5.2.3.nupkg

[mend-bolt-for-github]

CVE-2018-8171 - High Severity Vulnerability

Vulnerable Libraries - microsoft.aspnet.webpages.3.2.3.nupkg, microsoft.aspnet.mvc.5.2.3.nupkg

microsoft.aspnet.webpages.3.2.3.nupkg

This package contains core runtime assemblies shared between ASP.NET MVC and ASP.NET Web Pages.

Library home page: https://api.nuget.org/packages/microsoft.aspnet.webpages.3.2.3.nupkg

Path to dependency file: /optimizely/tests/DbLocalizationProvider.EPiServer.Sample/DbLocalizationProvider.EPiServer.Sample.csproj

Path to vulnerable library: /optimizely/tests/DbLocalizationProvider.EPiServer.Sample/DbLocalizationProvider.EPiServer.Sample.csproj,/optimizely/tests/DbLocalizationProvider.EPiServer.Sample/packages/Microsoft.AspNet.WebPages.3.2.3/Microsoft.AspNet.WebPages.3.2.3.nupkg,/optimizely/tests/DbLocalizationProvider.EPiServer.Tests/packages/Microsoft.AspNet.WebPages.3.2.3/Microsoft.AspNet.WebPages.3.2.3.nupkg

Dependency Hierarchy:

• ❌ microsoft.aspnet.webpages.3.2.3.nupkg (Vulnerable Library)

microsoft.aspnet.mvc.5.2.3.nupkg

This package contains the runtime assemblies for ASP.NET MVC.

Library home page: https://api.nuget.org/packages/microsoft.aspnet.mvc.5.2.3.nupkg

Dependency Hierarchy:

• ❌ microsoft.aspnet.mvc.5.2.3.nupkg (Vulnerable Library)

Found in HEAD commit: 06f898487e37c324749f8625ef95f65e5e90a1bf

Found in base branch: master

Vulnerability Details

A Security Feature Bypass vulnerability exists in ASP.NET when the number of incorrect login attempts is not validated, aka "ASP.NET Security Feature Bypass Vulnerability." This affects ASP.NET, ASP.NET Core 1.1, ASP.NET Core 1.0, ASP.NET Core 2.0, ASP.NET MVC 5.2.

Publish Date: 2018-07-11

URL: CVE-2018-8171

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2018-07-11

Fix Resolution: Microsoft.AspNetCore.Identity - 1.1.6

---

Step up your Open Source Security Game with Mend here