{"action":"Upgrade Microsoft.AspNetCore.Identity to 1.0.6 (1.0.x), 1.1.6 (1.1.x), 2.0.4 (2.0.x) or 2.1.2 (2.1.x) or later.","affected":[{"fixed":"1.0.6","introduced":"1.0.0"},{"fixed":"1.1.6","introduced":"1.1.0"},{"fixed":"2.0.4","introduced":"2.0.0"},{"fixed":"2.1.2","introduced":"2.1.0"}],"component":"Microsoft.AspNetCore.Identity","cve_ids":["CVE-2018-8171"],"ecosystem":"NuGet","epss":0.10774,"exploited":false,"fixed_versions":["1.0.6","1.1.6","2.0.4","2.1.2"],"ghsa_id":"GHSA-vhvh-528q-ff3p","id":"tcs_01M5N928EFGF50VBDE1AY4SHA2","modified_at":"2023-11-08T04:00:26.077954Z","published_at":"2018-10-16T19:56:50Z","references":["https://osv.dev/vulnerability/GHSA-vhvh-528q-ff3p","https://nvd.nist.gov/vuln/detail/CVE-2018-8171","https://github.com/advisories/GHSA-vhvh-528q-ff3p","https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8171","http://www.securityfocus.com/bid/104659","http://www.securitytracker.com/id/1041267"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-vhvh-528q-ff3p","url":"https://osv.dev/vulnerability/GHSA-vhvh-528q-ff3p"}],"summary":"Security feature bypass vulnerability exists in ASP.NET when the number of incorrect login attempts is not validated"}