.NET and Visual Studio Denial of Service Vulnerability
CVE-2023-38180

7.5HIGH

Key Information:

Vendor

Microsoft
Status
Asp.net Core 2.1
.net 6.0
.net 7.0
Microsoft Visual Studio 2022 Version 17.2
Vendor
CVE Published:
8 August 2023

Badges

👾 Exploit Exists🦅 CISA Reported

What is CVE-2023-38180?

A security weakness in .NET and Visual Studio that allows attackers to exploit the system, potentially leading to denial of service conditions. This vulnerability may allow an attacker to create a denial of service situation, interrupting services reliant on these platforms. Users are encouraged to review the vendor advisory for mitigation strategies.

CISA has reported CVE-2023-38180

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2023-38180 as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace

The CISA's recommendation is: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Affected Version(s)

.NET 6.0 Unknown 6.0.0 < 6.0.21

.NET 7.0 Unknown 7.0.0 < 7.0.10

ASP.NET Core 2.1 Unknown 2.0 < 2.1.40

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE...
vendor-advisory

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 👾

    Exploit known to exist

  • 🦅

    CISA Reported

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2023-38180 : .NET and Visual Studio Denial of Service Vulnerability