.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability
CVE-2023-24936

7.5HIGH

Key Information:

Vendor

Microsoft
Status
Microsoft Visual Studio 2022 Version 17.2
Microsoft Visual Studio 2022 Version 17.0
Microsoft Visual Studio 2022 Version 17.4
.net 6.0
Vendor
CVE Published:
14 June 2023

What is CVE-2023-24936?

This vulnerability in the .NET Framework and Visual Studio enables unauthorized elevation of privileges, potentially allowing attackers to execute arbitrary code with higher permissions. It affects multiple versions of the .NET Framework and Visual Studio products, necessitating updates to mitigate potential security risks.

Affected Version(s)

.NET 6.0 Unknown 6.0.0 < 6.0.18

.NET 7.0 Unknown 7.0.0 < 7.0.7

Microsoft .NET Framework 2.0 Service Pack 2 Windows Server 2008 for 32-bit Systems Service Pack 2 2.0.0 < 3.0.6920.8954; 2.0.50727.8970

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE...
vendor-advisory

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.