CVE-2018-8171

This is a flaw in the part of an ASP.NET application that should slow down or stop repeated wrong-password attempts. It is like a door guard who keeps letting someone try keys without recording the failed attempts, making it easier to keep guessing until a key works.

This matters to you if you run an ASP.NET application with Microsoft.AspNetCore.Identity handling customer, employee, or administrator sign-ins. It is relevant where the application does not properly enforce limits on incorrect login attempts.

Attackers can repeatedly try passwords against affected sign-in pages, potentially bypassing account-lockout protections. No active exploitation is listed by CISA and no public exploit code is on record, so this is an amber-priority update: schedule remediation promptly and protect exposed login pages in the meantime.

Confirm exposure by reviewing deployed application dependencies and lock files for Microsoft.AspNetCore.Identity, then identify the application’s ASP.NET Core branch. Upgrade to at least 1.0.6 on the 1.0 branch, 1.1.6 on 1.1, 2.0.4 on 2.0, or 2.1.2 on 2.1; test authentication and lockout behavior after deployment because framework upgrades can require application compatibility testing. If patching is delayed, limit access to administrative or sensitive sign-in endpoints and apply rate limiting or equivalent controls in front of them. This CVE is not in CISA KEV, so there is no CISA remediation due date. Monitor failed-login volume, repeated attempts against individual accounts, and unexpected successful logins.

CVSS v3.0 is 7.5 (High): AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. The weakness is CWE-287, involving failure to validate the number of incorrect authentication attempts, enabling a security-feature bypass through network-accessible login functionality. CISA KEV does not list this CVE, and no public exploit code is on record. EPSS estimates a 10.5% likelihood (96th percentile) and reports a falling trend; this is predictive rather than evidence of exploitation.