PT-2023-2927 · Microsoft+4 · .Net Framework+4

Ycdxsb · Published 2023-04-11 · Updated 2025-02-03 · CVE-2023-28260

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Microsoft .NET (affected versions not specified)

Description The issue is related to incorrect handling of the path search for DLL libraries in the Microsoft .NET platform. This can allow an attacker to execute arbitrary code.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

Related Identifiers

ALT-PU-2023-4590

ALT-PU-2023-4591

ALT-PU-2023-4592

ALT-PU-2023-4593

ALT-PU-2023-4594

ALT-PU-2023-4595

ALT-PU-2023-4610

ALT-PU-2023-4611

ALT-PU-2024-16792

ALT-PU-2024-16794

ALT-PU-2024-16796

ALT-PU-2024-16939

BDU:2023-02907

BIT-DOTNET-2023-28260

BIT-DOTNET-SDK-2023-28260

CVE-2023-28260

GHSA-W4M3-43GP-X8HX

USN-6006-1

Affected Products

Alt Linux

Linuxmint

.Net Framework

Red Os

Ubuntu

References · 18

• https://osv.dev/vulnerability/USN-6006-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-28260 · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-02907 · Security Note
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28260 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-28260 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-dotnet-2023-28260 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-w4m3-43gp-x8hx · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-28260 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-dotnet-sdk-2023-28260 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-28260 · Security Note
• https://ubuntu.com/security/notices/USN-6006-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-28260 · Security Note
• https://safe-surf.ru/specialists/bulletins-nkcki/701244 · Security Note
• https://github.com/dotnet/runtime · Note