Visual Studio Remote Code Execution Vulnerability
CVE-2023-23381

7.8HIGH

Key Information:

Vendor

Microsoft
Status
Microsoft Visual Studio 2019 Version 16.11 (includes 16.0 - 16.10)
Microsoft Visual Studio 2022 Version 17.0
Microsoft Visual Studio 2022 Version 17.2
Microsoft Visual Studio 2017 Version 15.9 (includes 15.0 - 15.8)
Vendor
CVE Published:
14 February 2023

What is CVE-2023-23381?

A remote code execution vulnerability exists in Visual Studio, allowing an attacker to execute arbitrary code on an affected system. This vulnerability arises due to improper handling of input data. When exploited, it could lead to unauthorized actions or access to sensitive data. Users are urged to update their Visual Studio installations to mitigate potential risks and safeguard their development environments.

Affected Version(s)

Microsoft Visual Studio 2013 Update 5 Unknown 12.0.0 < 12.0.40700.0

Microsoft Visual Studio 2015 Update 3 Unknown 14.0.0 < 14.0.27555.0

Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8) Unknown 15.9.0 < 15.9.52

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE...
vendor-advisory

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.