.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability
CVE-2023-24936

7.5HIGH

Key Information:

Vendor
Microsoft
Status
Microsoft Visual Studio 2022 Version 17.2
Microsoft Visual Studio 2022 Version 17.0
Microsoft Visual Studio 2022 Version 17.4
.net 6.0
Vendor
CVE Published:
14 June 2023

Summary

This vulnerability in the .NET Framework and Visual Studio enables unauthorized elevation of privileges, potentially allowing attackers to execute arbitrary code with higher permissions. It affects multiple versions of the .NET Framework and Visual Studio products, necessitating updates to mitigate potential security risks.

Affected Version(s)

.NET 6.0 Unknown 6.0.0 < 6.0.18

.NET 7.0 Unknown 7.0.0 < 7.0.7

Microsoft .NET Framework 2.0 Service Pack 2 Windows Server 2008 for 32-bit Systems Service Pack 2 2.0.0 < 3.0.6920.8954; 2.0.50727.8970

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE...
vendor-advisory

EPSS Score

0% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Collectors

NVD DatabaseMitre Database
.