HIGH7.5
GHSA-vhvh-528q-ff3p
Security feature bypass vulnerability exists in ASP.NET when the number of incorrect login attempts is not validated
Quick fix
GHSA-vhvh-528q-ff3p — Microsoft.AspNetCore.Identity: upgrade to the fixed version with the command below.
dotnet add package Microsoft.AspNetCore.Identity --version 1.0.6Details
A Security Feature Bypass vulnerability exists in ASP.NET when the number of incorrect login attempts is not validated, aka "ASP.NET Security Feature Bypass Vulnerability." This affects ASP.NET, ASP.NET Core 1.1, ASP.NET Core 1.0, ASP.NET Core 2.0, ASP.NET MVC 5.2.
Are you affected?
Enter the version of the package you're using.
Affected packages
NuGet/Microsoft.AspNetCore.Identity
Introduced in:
1.0.0Fixed in: 1.0.6Fix
dotnet add package Microsoft.AspNetCore.Identity --version 1.0.6NuGet/Microsoft.AspNetCore.Identity
Introduced in:
1.1.0Fixed in: 1.1.6Fix
dotnet add package Microsoft.AspNetCore.Identity --version 1.1.6NuGet/Microsoft.AspNetCore.Identity
Introduced in:
2.0.0Fixed in: 2.0.4Fix
dotnet add package Microsoft.AspNetCore.Identity --version 2.0.4NuGet/Microsoft.AspNetCore.Identity
Introduced in:
2.1.0Fixed in: 2.1.2Fix
dotnet add package Microsoft.AspNetCore.Identity --version 2.1.2