Vulnerability · Published Nov 14, 2023 · Assigned by microsoft
CVE-2023-36038ASP.NET Core Denial of Service Vulnerability
High 8.2
In plain English
A high-severity uncontrolled resource consumption in ASP.NET Core 8.0 from Microsoft. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.8% (higher than 86% of all known vulnerabilities).
Severity (CVSS 3.1)8.2High
Exploit odds (30 days)2.8%top 13.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
ASP.NET Core Denial of Service Vulnerability
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Microsoft | ASP.NET Core 8.0 | 8.0 – before 8.0.0 |
| Microsoft | Microsoft Visual Studio 2022 version 17.2 | 17.2.0 – before 17.2.22 |
| Microsoft | Microsoft Visual Studio 2022 version 17.4 | 17.4.0 – before 17.4.14 |
| Microsoft | Microsoft Visual Studio 2022 version 17.6 | 17.6.0 – before 17.6.10 |
| Microsoft | Microsoft Visual Studio 2022 version 17.7 | 17.7.0 – before 17.7.7 |
| Microsoft | .NET 8.0 | 8.0 – before 8.0.0 |
Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H/E:U/RL:O/RC:C
References
- ASP.NET Core Denial of Service Vulnerability vendor-advisory