Log in Start free

Vulnerability · Published Nov 14, 2023 · Assigned by microsoft

CVE-2023-36049.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability

High 7.6

In plain English

A high-severity improper input validation in Microsoft .NET Framework 2.0 Service Pack 2 from Microsoft. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 6.8% (higher than 94% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.6High
Exploit odds (30 days)6.8%top 6.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8aspnetcore-runtime-6.06.0.25-1.el8_9ALSA-2023:7258
AlmaLinux:9aspnetcore-runtime-6.06.0.25-1.el9_3ALSA-2023:7257
AlmaLinux:8aspnetcore-runtime-7.07.0.14-1.el8_9ALSA-2023:7256
AlmaLinux:9aspnetcore-runtime-7.07.0.14-1.el9_3ALSA-2023:7255
AlmaLinux:8aspnetcore-runtime-8.08.0.0-2.el8_9ALSA-2023:7254
AlmaLinux:9aspnetcore-runtime-8.08.0.0-2.el9_3ALSA-2023:7253
AlmaLinux:8aspnetcore-targeting-pack-6.06.0.25-1.el8_9ALSA-2023:7258
AlmaLinux:9aspnetcore-targeting-pack-6.06.0.25-1.el9_3ALSA-2023:7257
AlmaLinux:8aspnetcore-targeting-pack-7.07.0.14-1.el8_9ALSA-2023:7256
AlmaLinux:9aspnetcore-targeting-pack-7.07.0.14-1.el9_3ALSA-2023:7255
AlmaLinux:8aspnetcore-targeting-pack-8.08.0.0-2.el8_9ALSA-2023:7254
AlmaLinux:9aspnetcore-targeting-pack-8.08.0.0-2.el9_3ALSA-2023:7253
AlmaLinux:8dotnet8.0.100-2.el8_9ALSA-2023:7254
AlmaLinux:8dotnet-apphost-pack-6.06.0.25-1.el8_9ALSA-2023:7258
AlmaLinux:9dotnet-apphost-pack-6.06.0.25-1.el9_3ALSA-2023:7257
AlmaLinux:8dotnet-apphost-pack-7.07.0.14-1.el8_9ALSA-2023:7256
AlmaLinux:9dotnet-apphost-pack-7.07.0.14-1.el9_3ALSA-2023:7255
AlmaLinux:8dotnet-apphost-pack-8.08.0.0-2.el8_9ALSA-2023:7254
AlmaLinux:9dotnet-apphost-pack-8.08.0.0-2.el9_3ALSA-2023:7253
AlmaLinux:8dotnet-host8.0.0-2.el8_9ALSA-2023:7254
AlmaLinux:9dotnet-host8.0.0-2.el9_3ALSA-2023:7253
AlmaLinux:8dotnet-hostfxr-6.06.0.25-1.el8_9ALSA-2023:7258
AlmaLinux:9dotnet-hostfxr-6.06.0.25-1.el9_3ALSA-2023:7257
AlmaLinux:8dotnet-hostfxr-7.07.0.14-1.el8_9ALSA-2023:7256
AlmaLinux:9dotnet-hostfxr-7.07.0.14-1.el9_3ALSA-2023:7255
AlmaLinux:8dotnet-hostfxr-8.08.0.0-2.el8_9ALSA-2023:7254
AlmaLinux:9dotnet-hostfxr-8.08.0.0-2.el9_3ALSA-2023:7253
AlmaLinux:8dotnet-runtime-6.06.0.25-1.el8_9ALSA-2023:7258
AlmaLinux:9dotnet-runtime-6.06.0.25-1.el9_3ALSA-2023:7257
AlmaLinux:8dotnet-runtime-7.07.0.14-1.el8_9ALSA-2023:7256
AlmaLinux:9dotnet-runtime-7.07.0.14-1.el9_3ALSA-2023:7255
AlmaLinux:8dotnet-runtime-8.08.0.0-2.el8_9ALSA-2023:7254
AlmaLinux:9dotnet-runtime-8.08.0.0-2.el9_3ALSA-2023:7253
AlmaLinux:8dotnet-sdk-6.06.0.125-1.el8_9ALSA-2023:7258
AlmaLinux:9dotnet-sdk-6.06.0.125-1.el9_3ALSA-2023:7257
AlmaLinux:8dotnet-sdk-6.0-source-built-artifacts6.0.125-1.el8_9ALSA-2023:7258
AlmaLinux:9dotnet-sdk-6.0-source-built-artifacts6.0.125-1.el9_3ALSA-2023:7257
AlmaLinux:8dotnet-sdk-7.07.0.114-1.el8_9ALSA-2023:7256
AlmaLinux:9dotnet-sdk-7.07.0.114-1.el9_3ALSA-2023:7255
AlmaLinux:8dotnet-sdk-7.0-source-built-artifacts7.0.114-1.el8_9ALSA-2023:7256
AlmaLinux:9dotnet-sdk-7.0-source-built-artifacts7.0.114-1.el9_3ALSA-2023:7255
AlmaLinux:8dotnet-sdk-8.08.0.100-2.el8_9ALSA-2023:7254
AlmaLinux:9dotnet-sdk-8.08.0.100-2.el9_3ALSA-2023:7253
AlmaLinux:8dotnet-sdk-8.0-source-built-artifacts8.0.100-2.el8_9ALSA-2023:7254
AlmaLinux:9dotnet-sdk-8.0-source-built-artifacts8.0.100-2.el9_3ALSA-2023:7253
AlmaLinux:8dotnet-targeting-pack-6.06.0.25-1.el8_9ALSA-2023:7258
AlmaLinux:9dotnet-targeting-pack-6.06.0.25-1.el9_3ALSA-2023:7257
AlmaLinux:8dotnet-targeting-pack-7.07.0.14-1.el8_9ALSA-2023:7256
AlmaLinux:9dotnet-targeting-pack-7.07.0.14-1.el9_3ALSA-2023:7255
AlmaLinux:8dotnet-targeting-pack-8.08.0.0-2.el8_9ALSA-2023:7254
AlmaLinux:9dotnet-targeting-pack-8.08.0.0-2.el9_3ALSA-2023:7253
AlmaLinux:8dotnet-templates-6.06.0.125-1.el8_9ALSA-2023:7258
AlmaLinux:9dotnet-templates-6.06.0.125-1.el9_3ALSA-2023:7257
AlmaLinux:8dotnet-templates-7.07.0.114-1.el8_9ALSA-2023:7256
AlmaLinux:9dotnet-templates-7.07.0.114-1.el9_3ALSA-2023:7255
AlmaLinux:8dotnet-templates-8.08.0.100-2.el8_9ALSA-2023:7254
AlmaLinux:9dotnet-templates-8.08.0.100-2.el9_3ALSA-2023:7253
AlmaLinux:8netstandard-targeting-pack-2.18.0.100-2.el8_9ALSA-2023:7254
AlmaLinux:9netstandard-targeting-pack-2.18.0.100-2.el9_3ALSA-2023:7253
Alpine:v3.20dotnet6-build6.0.125-r0ALPINE-CVE-2023-36049
Alpine:v3.20dotnet6-runtime6.0.25-r0ALPINE-CVE-2023-36049
NuGetsystem.net.requests6.0.25GHSA-c3hf-8vgx-72rh
NuGetsystem.net.requests7.0.14GHSA-c3hf-8vgx-72rh
NuGetsystem.net.requests8.0.0GHSA-c3hf-8vgx-72rh
Rocky Linux:8dotnet6.00:6.0.125-1.el8_9RLSA-2023:7258
Rocky Linux:8dotnet7.00:7.0.114-1.el8_9RLSA-2023:7256
Ubuntu:22.04:LTSdotnet66.0.125-0ubuntu1~22.04.1USN-6480-1
Ubuntu:22.04:LTSdotnet66.0.125-0ubuntu1~22.04.1UBUNTU-CVE-2023-36049
Ubuntu:22.04:LTSdotnet77.0.114-0ubuntu1~22.04.1UBUNTU-CVE-2023-36049
Ubuntu:22.04:LTSdotnet77.0.114-0ubuntu1~22.04.1USN-6480-1

Affected products (as reported)

VendorProductVersions
Microsoft Microsoft Visual Studio 2022 version 17.2 17.2.0 – before 17.2.22
Microsoft Microsoft Visual Studio 2022 version 17.4 17.4.0 – before 17.4.14
Microsoft Microsoft Visual Studio 2022 version 17.7 17.7.0 – before 17.7.7
Microsoft Microsoft Visual Studio 2022 version 17.6 17.6.0 – before 17.6.10
Microsoft .NET 8.0 8.0 – before 8.0.0
Microsoft .NET 6.0 6.0.0 – before 6.0.25
Microsoft .NET 7.0 7.0.0 – before 7.0.14
Microsoft Microsoft .NET Framework 3.5 AND 4.8.1 4.8.1 – before 4.8.9206.0
Microsoft Microsoft .NET Framework 4.8 4.8.0 – before 4.8.4682.0
Microsoft Microsoft .NET Framework 3.5 AND 4.8 4.8.0 – before 4.8.4682.0
Microsoft Microsoft .NET Framework 3.5 AND 4.7.2 4.7.0 – before 4.7.4076.0
Microsoft Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 3.0.0.0 – before 10.0.14393.6452
Microsoft Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 4.7.0 – before 4.7.4076.0
Microsoft Microsoft .NET Framework 4.6.2 4.7.0 – before 4.7.4076.0
Microsoft Microsoft .NET Framework 3.5 AND 4.6/4.6.2 10.0.0 – before 10.0.10240.20308
Microsoft Microsoft .NET Framework 2.0 Service Pack 2 2.0.0 – before 3.0.50727.8975
Microsoft Microsoft .NET Framework 3.0 Service Pack 2 3.0.0 – before 3.0.50727.8975
Microsoft Microsoft .NET Framework 3.5 3.5.0 – before 3.0.50727.8975
Microsoft Microsoft .NET Framework 3.5.1 3.5.0 – before 3.0.50727.8975

Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L/E:P/RL:O/RC:C

References