Vulnerability · Published Jun 14, 2023 · Assigned by microsoft

CVE-2023-24936.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability

High 7.5

In plain English

A high-severity security flaw in Microsoft .NET Framework 2.0 Service Pack 2 from Microsoft. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 75% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)1.6%top 24.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
AlmaLinux:8	aspnetcore-runtime-6.0	6.0.18-1.el8_8	ALSA-2023:3582
AlmaLinux:9	aspnetcore-runtime-6.0	6.0.18-1.el9_2	ALSA-2023:3581
AlmaLinux:8	aspnetcore-runtime-7.0	7.0.7-1.el8_8	ALSA-2023:3593
AlmaLinux:9	aspnetcore-runtime-7.0	7.0.7-1.el9_2	ALSA-2023:3592
AlmaLinux:8	aspnetcore-targeting-pack-6.0	6.0.18-1.el8_8	ALSA-2023:3582
AlmaLinux:9	aspnetcore-targeting-pack-6.0	6.0.18-1.el9_2	ALSA-2023:3581
AlmaLinux:8	aspnetcore-targeting-pack-7.0	7.0.7-1.el8_8	ALSA-2023:3593
AlmaLinux:9	aspnetcore-targeting-pack-7.0	7.0.7-1.el9_2	ALSA-2023:3592
AlmaLinux:8	dotnet	7.0.107-1.el8_8	ALSA-2023:3593
AlmaLinux:8	dotnet-apphost-pack-6.0	6.0.18-1.el8_8	ALSA-2023:3582
AlmaLinux:9	dotnet-apphost-pack-6.0	6.0.18-1.el9_2	ALSA-2023:3581
AlmaLinux:8	dotnet-apphost-pack-7.0	7.0.7-1.el8_8	ALSA-2023:3593
AlmaLinux:9	dotnet-apphost-pack-7.0	7.0.7-1.el9_2	ALSA-2023:3592
AlmaLinux:8	dotnet-host	7.0.7-1.el8_8	ALSA-2023:3593
AlmaLinux:9	dotnet-host	7.0.7-1.el9_2	ALSA-2023:3592
AlmaLinux:8	dotnet-hostfxr-6.0	6.0.18-1.el8_8	ALSA-2023:3582
AlmaLinux:9	dotnet-hostfxr-6.0	6.0.18-1.el9_2	ALSA-2023:3581
AlmaLinux:8	dotnet-hostfxr-7.0	7.0.7-1.el8_8	ALSA-2023:3593
AlmaLinux:9	dotnet-hostfxr-7.0	7.0.7-1.el9_2	ALSA-2023:3592
AlmaLinux:8	dotnet-runtime-6.0	6.0.18-1.el8_8	ALSA-2023:3582
AlmaLinux:9	dotnet-runtime-6.0	6.0.18-1.el9_2	ALSA-2023:3581
AlmaLinux:8	dotnet-runtime-7.0	7.0.7-1.el8_8	ALSA-2023:3593
AlmaLinux:9	dotnet-runtime-7.0	7.0.7-1.el9_2	ALSA-2023:3592
AlmaLinux:8	dotnet-sdk-6.0	6.0.118-1.el8_8	ALSA-2023:3582
AlmaLinux:9	dotnet-sdk-6.0	6.0.118-1.el9_2	ALSA-2023:3581
AlmaLinux:8	dotnet-sdk-6.0-source-built-artifacts	6.0.118-1.el8_8	ALSA-2023:3582
AlmaLinux:9	dotnet-sdk-6.0-source-built-artifacts	6.0.118-1.el9_2	ALSA-2023:3581
AlmaLinux:8	dotnet-sdk-7.0	7.0.107-1.el8_8	ALSA-2023:3593
AlmaLinux:9	dotnet-sdk-7.0	7.0.107-1.el9_2	ALSA-2023:3592
AlmaLinux:8	dotnet-sdk-7.0-source-built-artifacts	7.0.107-1.el8_8	ALSA-2023:3593
AlmaLinux:9	dotnet-sdk-7.0-source-built-artifacts	7.0.107-1.el9_2	ALSA-2023:3592
AlmaLinux:8	dotnet-targeting-pack-6.0	6.0.18-1.el8_8	ALSA-2023:3582
AlmaLinux:9	dotnet-targeting-pack-6.0	6.0.18-1.el9_2	ALSA-2023:3581
AlmaLinux:8	dotnet-targeting-pack-7.0	7.0.7-1.el8_8	ALSA-2023:3593
AlmaLinux:9	dotnet-targeting-pack-7.0	7.0.7-1.el9_2	ALSA-2023:3592
AlmaLinux:8	dotnet-templates-6.0	6.0.118-1.el8_8	ALSA-2023:3582
AlmaLinux:9	dotnet-templates-6.0	6.0.118-1.el9_2	ALSA-2023:3581
AlmaLinux:8	dotnet-templates-7.0	7.0.107-1.el8_8	ALSA-2023:3593
AlmaLinux:9	dotnet-templates-7.0	7.0.107-1.el9_2	ALSA-2023:3592
AlmaLinux:8	netstandard-targeting-pack-2.1	7.0.107-1.el8_8	ALSA-2023:3593
AlmaLinux:9	netstandard-targeting-pack-2.1	7.0.107-1.el9_2	ALSA-2023:3592
Alpine:v3.20	dotnet6-build	6.0.118-r0	ALPINE-CVE-2023-24936
Alpine:v3.20	dotnet6-runtime	6.0.18-r0	ALPINE-CVE-2023-24936
NuGet	microsoft.netcore.app.runtime.linux-arm	6.0.18	GHSA-jx7q-xxmw-44vf
NuGet	microsoft.netcore.app.runtime.linux-arm	7.0.7	GHSA-jx7q-xxmw-44vf
NuGet	microsoft.netcore.app.runtime.linux-arm64	7.0.7	GHSA-jx7q-xxmw-44vf
NuGet	microsoft.netcore.app.runtime.linux-arm64	6.0.18	GHSA-jx7q-xxmw-44vf
NuGet	microsoft.netcore.app.runtime.linux-musl-arm	6.0.18	GHSA-jx7q-xxmw-44vf
NuGet	microsoft.netcore.app.runtime.linux-musl-arm	7.0.7	GHSA-jx7q-xxmw-44vf
NuGet	microsoft.netcore.app.runtime.linux-musl-arm64	7.0.7	GHSA-jx7q-xxmw-44vf
NuGet	microsoft.netcore.app.runtime.linux-musl-arm64	6.0.18	GHSA-jx7q-xxmw-44vf
NuGet	microsoft.netcore.app.runtime.linux-musl-x64	6.0.18	GHSA-jx7q-xxmw-44vf
NuGet	microsoft.netcore.app.runtime.linux-musl-x64	7.0.7	GHSA-jx7q-xxmw-44vf
NuGet	microsoft.netcore.app.runtime.linux-x64	7.0.7	GHSA-jx7q-xxmw-44vf
NuGet	microsoft.netcore.app.runtime.linux-x64	6.0.18	GHSA-jx7q-xxmw-44vf
NuGet	microsoft.netcore.app.runtime.osx-arm64	6.0.18	GHSA-jx7q-xxmw-44vf
NuGet	microsoft.netcore.app.runtime.osx-arm64	7.0.7	GHSA-jx7q-xxmw-44vf
NuGet	microsoft.netcore.app.runtime.osx-x64	7.0.7	GHSA-jx7q-xxmw-44vf
NuGet	microsoft.netcore.app.runtime.osx-x64	6.0.18	GHSA-jx7q-xxmw-44vf
NuGet	microsoft.netcore.app.runtime.win-arm	7.0.7	GHSA-jx7q-xxmw-44vf
NuGet	microsoft.netcore.app.runtime.win-arm	6.0.18	GHSA-jx7q-xxmw-44vf
NuGet	microsoft.netcore.app.runtime.win-arm64	7.0.7	GHSA-jx7q-xxmw-44vf
NuGet	microsoft.netcore.app.runtime.win-arm64	6.0.18	GHSA-jx7q-xxmw-44vf
NuGet	microsoft.netcore.app.runtime.win-x64	6.0.18	GHSA-jx7q-xxmw-44vf
NuGet	microsoft.netcore.app.runtime.win-x64	7.0.7	GHSA-jx7q-xxmw-44vf
NuGet	microsoft.netcore.app.runtime.win-x86	7.0.7	GHSA-jx7q-xxmw-44vf
NuGet	microsoft.netcore.app.runtime.win-x86	6.0.18	GHSA-jx7q-xxmw-44vf
Rocky Linux:8	dotnet6.0	0:6.0.118-1.el8_8	RLSA-2023:3582
Rocky Linux:8	dotnet7.0	0:7.0.107-1.el8_8	RLSA-2023:3593
Ubuntu:22.04:LTS	dotnet6	6.0.118-0ubuntu1~22.04.1	USN-6161-1
Ubuntu:22.04:LTS	dotnet6	6.0.118-0ubuntu1~22.04.1	UBUNTU-CVE-2023-24936
Ubuntu:22.04:LTS	dotnet7	7.0.107-0ubuntu1~22.04.1	UBUNTU-CVE-2023-24936
Ubuntu:22.04:LTS	dotnet7	7.0.107-0ubuntu1~22.04.1	USN-6161-1

Affected products (as reported)

Vendor	Product	Versions
Microsoft	Microsoft Visual Studio 2022 version 17.2	17.2.0 – before 17.2.16
Microsoft	Microsoft Visual Studio 2022 version 17.0	17.0.0 – before 17.0.22
Microsoft	Microsoft Visual Studio 2022 version 17.4	17.4.0 – before 17.4.8
Microsoft	.NET 6.0	6.0.0 – before 6.0.18
Microsoft	.NET 7.0	7.0.0 – before 7.0.7
Microsoft	Microsoft Visual Studio 2022 version 17.6	17.6.0 – before 17.6.3
Microsoft	PowerShell 7.2	7.2.0 – before 7.2.12
Microsoft	PowerShell 7.3	7.3.0 – before 7.3.5
Microsoft	Microsoft .NET Framework 4.8	4.8.0 – before 4.8.4644.0
Microsoft	Microsoft .NET Framework 3.5 AND 4.8	4.8.0 – before 4.8.4644.0
Microsoft	Microsoft .NET Framework 3.5 AND 4.7.2	4.7.0 – before 4.7.4050.0
Microsoft	Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2	3.0.0.0 – before 10.0.14393.5989
Microsoft	Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2	4.7.0 – before 4.7.04043.0
Microsoft	Microsoft .NET Framework 3.5 AND 4.8.1	4.8.1 – before 4.8.9166.0
Microsoft	Microsoft .NET Framework 4.6.2	4.7.0 – before 4.7.04043.0
Microsoft	Microsoft .NET Framework 3.5 and 4.6.2	4.7.0 – before 10.0.10240.19983
Microsoft	Microsoft .NET Framework 2.0 Service Pack 2	2.0.0 – before 3.0.6920.8954; 2.0.50727.8970
Microsoft	Microsoft .NET Framework 3.0 Service Pack 2	3.0.0 – before 3.0.6920.8954; 2.0.50727.8970
Microsoft	Microsoft .NET Framework 3.5.1	3.5.0 – before 3.0.6920.8954; 2.0.50727.8970
Microsoft	Microsoft .NET Framework 3.5	3.5.0 – before 3.0.6920.8954; 2.0.50727.8970

References

.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability vendor-advisory