How severe is CVE-2023-33170?

CVE-2023-33170 has a CVSS score of 8.1/10, rated HIGH. Immediate patching is strongly recommended.

Which packages are affected by CVE-2023-33170?

CVE-2023-33170 affects the following packages: Microsoft.AspNetCore.Identity (NuGet), Microsoft.AspNet.Identity.Owin (NuGet), Microsoft.AspNetCore.App.Runtime.linux-arm (NuGet), Microsoft.AspNetCore.App.Runtime.linux-arm64 (NuGet), Microsoft.AspNetCore.App.Runtime.linux-musl-arm (NuGet), Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 (NuGet), Microsoft.AspNetCore.App.Runtime.linux-x64 (NuGet), Microsoft.AspNetCore.App.Runtime.osx-x64 (NuGet), and 18 more. Ecosystems affected: NuGet.

How do I fix CVE-2023-33170?

Update Microsoft.AspNetCore.Identity to 2.1.39 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2023-33170 is resolved across your whole dependency graph.

How do I detect CVE-2023-33170 in my NuGet dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for Microsoft.AspNetCore.Identity, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

How do I mitigate CVE-2023-33170 if there is no patch (or I can't update yet)?

If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

How does O3 Security protect against CVE-2023-33170?

O3 Security's impact-aware SCA analyses which vulnerable code paths your application actually calls, so a match like CVE-2023-33170 can be triaged on real exposure rather than presence alone.

Is CVE-2023-33170 actively exploited in the wild?

No public exploit code has been indexed for CVE-2023-33170 yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

What is the EPSS score for CVE-2023-33170?

CVE-2023-33170 has an EPSS (Exploit Prediction Scoring System) score of 2.0%, placing it in the 80th percentile of all CVEs. EPSS is maintained by FIRST.org and estimates the probability that a vulnerability will be exploited in the wild within the next 30 days. This score indicates relatively lower exploitation probability, though the CVSS severity should still guide your patching priority.

What type of vulnerability is CVE-2023-33170?

CVE-2023-33170 is classified as CWE-362 (CWE-362). This weakness type describe the underlying flaw category, which helps determine the potential impact and the right class of mitigation.

When was CVE-2023-33170 published, and has it been updated?

CVE-2023-33170 was published on July 11, 2023 and was last updated on July 8, 2026. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

.NET

.NET NuGet

Not in CISA KEV

HIGH severity

CVE-2023-33170 — Microsoft.AspNetCore.Iden…

HIGH

CVE-2023-33170 is a high-severity (CVSS 8.1) CWE-362 vulnerability in Microsoft.AspNetCore.Identity. A fix is available for Microsoft.AspNetCore.Identity — see the affected versions and patch details below.

Microsoft Security Advisory CVE-2023-33170: .NET Security Feature Bypass Vulnerability

Also known asBIT-dotnet-2023-33170BIT-dotnet-sdk-2023-33170GHSA-25c8-p796-jg6r

Published

Jul 11, 2023

Updated

Jul 8, 2026

Affected

26 pkgs

Patched

26 / 26

Exploits

None indexed

Exploitation data as of Sep 22, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

No confirmed exploitation observed yet

A successful exploit gives an attacker total control of the affected component, not partial access.
CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for CVE-2023-33170.

EPSS Exploitation Probability

via FIRST.org ↗

2.0%probability of exploitation in next 30 days

Lower Risk0.00%

Lower risk than most CVEs80th percentile — riskier than 80% of all scored CVEsHighest risk

EPSS (Exploit Prediction Scoring System) is a daily probability model maintained by FIRST.org. It estimates the likelihood a CVE will be exploited in production environments within the next 30 days, derived from real-world threat intelligence signals.

How urgent is this, really

CVE-2023-33170 plotted by exploitation likelihood (EPSS) against impact (CVSS). The shaded corner — EPSS 50%+ and CVSS 7.0+ — is where this CVE doesn't sit, though severity or exploitability alone can still warrant action.

Where this sits among everything scored

Of 378,156 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Real counts from FIRST.org, not a sample — log-scaled since the landscape is heavily right-skewed.

Real-World Exposure

26 pkgs affected

.NETMicrosoft.AspNetCore.Identity.NETMicrosoft.AspNet.Identity.Owin.NETMicrosoft.AspNetCore.App.Runtime.linux-arm.NETMicrosoft.AspNetCore.App.Runtime.linux-arm64.NETMicrosoft.AspNetCore.App.Runtime.linux-musl-arm.NETMicrosoft.AspNetCore.App.Runtime.linux-musl-arm64.NETMicrosoft.AspNetCore.App.Runtime.linux-x64.NETMicrosoft.AspNetCore.App.Runtime.osx-x64+18 more

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects NuGet packages — download data is not available via public APIs for these ecosystems.

Description

Microsoft Security Advisory CVE-2023-33170: .NET Security Feature Bypass Vulnerability

Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core 2.1 and above. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

A vulnerability exist in ASP.NET Core applications where account lockout maximum failed attempts may not be immediately updated, allowing an attacker to try more passwords.

Discussion

Discussion for this issue can be found at https://github.com/dotnet/aspnetcore/issues/49334

Mitigation factors

Microsoft has not identified any mitigating factors for this vulnerability.

Affected software

Any ASP.NET 7.0 application running on .NET 7.0.8 or earlier.
Any ASP.NET 6.0 application running on .NET 6.0.19 or earlier.
Any ASP.NET Core 2.1 application consuming the package Microsoft.AspNetCore.Identity version 2.1.31 or earlier.

If your application uses the following package versions, ensure you update to the latest version of .NET.

ASP.NET Core 2.1

Package name	Affected version	Patched version
Microsoft.AspNetCore.Identity	<=2.1.39	2.1.39

Microsoft.AspNet.Identity.Owin

Package name	Affected version	Patched version
Microsoft.AspNet.Identity.Owin	<= 2.2.3	2.2.4

ASP.NET 6.0

Package name	Affected version	Patched version

ASP.NET 7.0

Package name	Affected version	Patched version
Microsoft.AspNetCore.App.Runtime.linux-arm	<= 7.0.9	7.0.9
Microsoft.AspNetCore.App.Runtime.linux-arm64	<= 7.0.9	7.0.9
Microsoft.AspNetCore.App.Runtime.linux-musl-arm	<= 7.0.9	7.0.9
Microsoft.AspNetCore.App.Runtime.linux-musl-arm64	<= 7.0.9	7.0.9
Microsoft.AspNetCore.App.Runtime.linux-musl-x64	<= 7.0.9	7.0.9
Microsoft.AspNetCore.App.Runtime.linux-x64	<= 7.0.9	7.0.9
Microsoft.AspNetCore.App.Runtime.osx-arm64	<= 7.0.9	7.0.9
Microsoft.AspNetCore.App.Runtime.osx-x64	<= 7.0.9	7.0.9
Microsoft.AspNetCore.App.Runtime.win-arm	<= 7.0.9	7.0.9
Microsoft.AspNetCore.App.Runtime.win-arm64	<= 7.0.9	7.0.9
Microsoft.AspNetCore.App.Runtime.win-x64	<= 7.0.9	7.0.9
Microsoft.AspNetCore.App.Runtime.win-x86	<= 7.0.9	7.0.9

Advisory FAQ

How do I know if I am affected?

If you have a runtime or SDK with a version listed, or an affected package listed in affected software, you're exposed to the vulnerability.

How do I fix the issue?

To fix the issue please install the latest version of .NET 6.0 or .NET 7.0. If you have installed one or more .NET SDKs through Visual Studio, Visual Studio will prompt you to update Visual Studio, which will also update your .NET SDKs.
If you are using one of the affected packages, please update to the patched version listed above.
If you have .NET 6.0 or greater installed, you can list the versions you have installed by running the dotnet --info command. You will see output like the following;

.NET Core SDK (reflecting any global.json):

 Version:   6.0.300
 Commit:    8473146e7d

Runtime Environment:

 OS Name:     Windows
 OS Version:  10.0.18363
 OS Platform: Windows
 RID:         win10-x64
 Base Path:   C:\Program Files\dotnet\sdk\6.0.300\

Host (useful for support):

  Version: 6.0.5
  Commit:  8473146e7d

.NET Core SDKs installed:

  6.0.300 [C:\Program Files\dotnet\sdk]

.NET Core runtimes installed:

  Microsoft.AspNetCore.App 6.0.5 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.NETCore.App 6.0.5 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.WindowsDesktop.App 6.0.5 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]

To install additional .NET Core runtimes or SDKs:
  https://aka.ms/dotnet-download

If you're using .NET 7.0, you should download and install Runtime 7.0.7 or SDK 7.0.106 (for Visual Studio 2022 v17.4) from https://dotnet.microsoft.com/download/dotnet-core/7.0.
If you're using .NET 6.0, you should download and install Runtime 6.0.18 or SDK 6.0.312 (for Visual Studio 2022 v17.2) from https://dotnet.microsoft.com/download/dotnet-core/6.0.
If you're using ASP.NET Core 2.1 and consuming the Microsoft.AspNetCore.Identity package, update that package to version 2.1.39

.NET 6.0 and and .NET 7.0 updates are also available from Microsoft Update. To access this either type "Check for updates" in your Windows search, or open Settings, choose Update & Security and then click Check for Updates.

Once you have installed the updated runtime or SDK, restart your apps for the update to take effect.

Additionally, if you've deployed self-contained applications targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.

Other Information

Reporting Security Issues

If you have found a potential security issue in .NET 6.0 or .NET 7.0, please email details to [email protected]. Reports may qualify for the Microsoft .NET Core & .NET 5 Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.

Support

You can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime and https://github.com/dotnet/aspnet/. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

External Links

CVE-2023-33170

Revisions

V1.0 (July 11, 2023): Advisory published.

Version 1.0

Last Updated 2023-07-11

Affected Packages

26 total 26 fixed

Ecosystem	Package	Vulnerable range	Fix
.NETNuGet	`Microsoft.AspNetCore.Identity`	all versions	2.1.39`dotnet add package Microsoft.AspNetCore.Identity --version 2.1.39`
.NETNuGet	`Microsoft.AspNet.Identity.Owin`	all versions	2.2.4`dotnet add package Microsoft.AspNet.Identity.Owin --version 2.2.4`
.NETNuGet	`Microsoft.AspNetCore.App.Runtime.linux-arm`	all versions	6.0.20`dotnet add package Microsoft.AspNetCore.App.Runtime.linux-arm --version 6.0.20`
.NETNuGet	`Microsoft.AspNetCore.App.Runtime.linux-arm64`	all versions	6.0.20`dotnet add package Microsoft.AspNetCore.App.Runtime.linux-arm64 --version 6.0.20`
.NETNuGet	`Microsoft.AspNetCore.App.Runtime.linux-musl-arm`	all versions	6.0.20`dotnet add package Microsoft.AspNetCore.App.Runtime.linux-musl-arm --version 6.0.20`
.NETNuGet	`Microsoft.AspNetCore.App.Runtime.linux-musl-arm64`	all versions	6.0.20`dotnet add package Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 --version 6.0.20`

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for Microsoft.AspNetCore.Identity, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update Microsoft.AspNetCore.Identity to 2.1.39 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2023-33170 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 Security's impact-aware SCA analyses which vulnerable code paths your application actually calls, so a match like CVE-2023-33170 can be triaged on real exposure rather than presence alone.

Tailored to CVE-2023-33170. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.

Fixing This On Your OS

If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.

Red HatImportant

Product	Fixed in	Advisory
.NET Core on Red Hat Enterprise Linux	`rh-dotnet60-dotnet-0:6.0.120-1.el7_9`	RHSA-2023:4061
Red Hat Enterprise Linux 8	`dotnet7.0-0:7.0.109-1.el8_8`	RHSA-2023:4058
Red Hat Enterprise Linux 8	`dotnet6.0-0:6.0.120-1.el8_8`	RHSA-2023:4059
Red Hat Enterprise Linux 8.6 Extended Update Support	`dotnet6.0-0:6.0.120-1.el8_6`	RHSA-2023:4448
Red Hat Enterprise Linux 9	`dotnet7.0-0:7.0.109-1.el9_2`	RHSA-2023:4057
Red Hat Enterprise Linux 9	`dotnet6.0-0:6.0.120-1.el9_2`	RHSA-2023:4060
Red Hat Enterprise Linux 9.0 Extended Update Support	`dotnet6.0-0:6.0.120-1.el9_0`	RHSA-2023:4449

UbuntuHIGH

USN-6217-1Ubuntu

Frequently Asked Questions

# Microsoft Security Advisory CVE-2023-33170: .NET Security Feature Bypass Vulnerability ## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core 2.1 and above. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A vulnerability exist in ASP.NET Core applications where account lockout maximum failed attempts may not be immediately updated, allowing an attacker to try more passwords. ## Discussion Discussion for this issue can be found at https://git

O3 Security · Impact-Aware SCA

Is CVE-2023-33170 in your dependencies?

O3 Security finds CVE-2023-33170 across NuGet dependencies, including transitive ones, and its impact-aware SCA ranks findings by whether your code actually calls the vulnerable path.

Scan my dependencies How O3 SCA works

CVSS Score

8.1/10CVSS v3 base

Vector breakdown

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Raw vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE Classification

CWE-362CWE-362

Weaponization

No known public exploit tooling found.

OpenSSF Scorecard

Package health score

aspnetcore

6.6/10

Code-Review8/10

Maintained10/10

Branch-Protection8/10

Assessed Sep 21, 2026

Timeline

Disclosed

Jul 11, 2023

Last updated

Jul 8, 2026

Identifiers

CVE-2023-33170

GHSA-25c8-p796-jg6r

BIT-dotnet-2023-33170

BIT-dotnet-sdk-2023-33170

References

Advisorynvd.nist.gov Fixmsrc.microsoft.com Articlelists.fedoraproject.org Articlelists.fedoraproject.org Articlelists.fedoraproject.org Articlelists.fedoraproject.org Webgithub.com Webgithub.com Weblists.fedoraproject.org Weblists.fedoraproject.org Weblists.fedoraproject.org Weblists.fedoraproject.org Packagegithub.com

Related vulnerabilities

Also affects Microsoft.AspNetCore.Identity

This CVE is high severity, in line with the other 2 CVEs affecting Microsoft.AspNetCore.Identity.

CVE-2025-24070CVE-2018-8171

Also affects Microsoft.AspNetCore.App.Runtime.linux-arm

This CVE is high severity; 6 of 6 other CVEs affecting Microsoft.AspNetCore.App.Runtime.linux-arm are rated as high or higher (top: critical).

CVE-2026-56170CVE-2026-42899CVE-2026-26130CVE-2025-55315CVE-2024-38229CVE-2024-35264

Provenance

Sources

OSV.devNVDFIRST.org (EPSS)

Last verifiedJul 8, 2026

CVE-2023-33170 — Microsoft.AspNetCore.Iden…

Exploitation Status

No confirmed exploitation observed yet

EPSS Exploitation Probability

How urgent is this, really

Where this sits among everything scored

Real-World Exposure

Description

Microsoft Security Advisory CVE-2023-33170: .NET Security Feature Bypass Vulnerability

Executive summary

Discussion

Mitigation factors

Affected software

ASP.NET Core 2.1

Microsoft.AspNet.Identity.Owin

ASP.NET 6.0

ASP.NET 7.0

Advisory FAQ

How do I know if I am affected?

How do I fix the issue?

Other Information

Reporting Security Issues

Support

Disclaimer

External Links

Revisions

Affected Packages

Detection & mitigation playbook

Detect

Fix

Workarounds

How O3 protects you

Fixing This On Your OS

Frequently Asked Questions

Is CVE-2023-33170 in your dependencies?