CVE-2023-24936

10 documents7 sources

Severity

7.5HIGH

EPSS

1.2%

top 21.42%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Microsoft .net 6.0 Microsoft .net 7.0 Microsoft Microsoft .net Framework 2.0 Service Pack 2 +19 more

Timeline

PublishedJun 14

Latest updateJun 23

Description

.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.6 | Impact: 5.9

Affected Packages36 packages

▶CVEListV5microsoft/microsoft_visual_studio_2022_version_17.017.0.0 — 17.0.22

▶CVEListV5microsoft/microsoft_visual_studio_2022_version_17.217.2.0 — 17.2.16

▶CVEListV5microsoft/microsoft_visual_studio_2022_version_17.417.4.0 — 17.4.8

▶CVEListV5microsoft/microsoft_visual_studio_2022_version_17.617.6.0 — 17.6.3

▶CVEListV5microsoft/microsoft_.net_framework_3.53.5.0 — 3.0.6920.8954; 2.0.50727.8970

Patches

Patch: msrc.microsoft.com ↗Patch: msrc.microsoft.com ↗

🔴Vulnerability Details

OSV

dotnet6, dotnet7 regression↗2023-06-23

▶

GHSA

.NET Elevation of Privilege Vulnerability↗2023-06-14

▶

CVEList

.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability↗2023-06-14

▶

OSV

.NET Elevation of Privilege Vulnerability↗2023-06-14

▶

OSV

CVE-2023-24936↗2023-06-13

▶

📋Vendor Advisories

Red Hat

dotnet: Bypass restrictions when deserializing a DataSet or DataTable from XML↗2023-06-14

▶

Ubuntu

.NET vulnerabilities↗2023-06-13

▶

Microsoft

.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability↗2023-06-13

▶