PT-2023-4295 · Microsoft+1 · Visual Studio+2

Brennan Conroy · Publicado 2023-08-08 · Atualizado 2024-12-13 · CVE-2023-35391

Positive Technologies (AI Summary)

CVSS v3.1

7.1

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions ASP.NET Core SignalR and Visual Studio (affected versions not specified)

Description The issue is related to insufficient access control in the software development tool Microsoft Visual Studio and the Microsoft .NET platform. This can potentially allow an attacker to elevate their privileges. There is no information provided about the estimated number of potentially affected devices worldwide or details about real-world incidents where this issue was exploited.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Information Disclosure

Enumeração de Fraquezas

CWE-20

CWE-200

Identificadores relacionados

ALT-PU-2024-1066

ALT-PU-2024-1067

ALT-PU-2024-1068

ALT-PU-2024-1069

ALT-PU-2024-16792

ALT-PU-2024-16794

ALT-PU-2024-16796

ALT-PU-2024-16939

ALT-PU-2024-2761

ALT-PU-2024-2763

ALT-PU-2024-2765

ALT-PU-2024-2767

BDU:2023-04615

BDU:2023-04621

BIT-ASPNET-CORE-2023-35391

BIT-DOTNET-2023-35391

BIT-DOTNET-SDK-2023-35391

CVE-2023-35391

GHSA-J8RM-CM55-QQJ6

Produtos afetados

Alt Linux

Asp.Net Core Signalr

Visual Studio

Referências · 17

• https://github.com/dotnet/aspnetcore · Nota
• https://github.com/dotnet/aspnetcore/security/advisories/GHSA-j8rm-cm55-qqj6 · Nota
• https://github.com/dotnet/announcements/issues/267 · Nota
• https://twitter.com/VulmonFeeds/status/1689012779808694272 · Publicação no Twitter
• https://bdu.fstec.ru/vul/2023-04621 · Nota de Segurança
• https://osv.dev/vulnerability/BIT-aspnet-core-2023-35391 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-35391 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-j8rm-cm55-qqj6 · Aviso do Fabricante
• https://access.redhat.com/security/cve/cve-2023-35390 · Nota
• https://vuldb.com/ru/?id.236551 · Nota
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35391 · Aviso do Fabricante
• https://ubuntu.com/security/notices/USN-6278-2 · Aviso do Fabricante
• https://osv.dev/vulnerability/BIT-dotnet-2023-35391 · Aviso do Fabricante
• https://osv.dev/vulnerability/BIT-dotnet-sdk-2023-35391 · Aviso do Fabricante
• https://cybersecurity-help.cz/vdb/SB2023081036 · Nota