PT-2023-4295 · Microsoft+1 · Visual Studio+2

Brennan Conroy · Published 2023-08-08 · Updated 2024-12-13 · CVE-2023-35391

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions ASP.NET Core SignalR and Visual Studio (affected versions not specified)

Description The issue is related to insufficient access control in the software development tool Microsoft Visual Studio and the Microsoft .NET platform. This can potentially allow an attacker to elevate their privileges. There is no information provided about the estimated number of potentially affected devices worldwide or details about real-world incidents where this issue was exploited.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Information Disclosure

Weakness Enumeration

CWE-20

CWE-200

Related Identifiers

ALT-PU-2024-1066

ALT-PU-2024-1067

ALT-PU-2024-1068

ALT-PU-2024-1069

ALT-PU-2024-16792

ALT-PU-2024-16794

ALT-PU-2024-16796

ALT-PU-2024-16939

ALT-PU-2024-2761

ALT-PU-2024-2763

ALT-PU-2024-2765

ALT-PU-2024-2767

BDU:2023-04615

BDU:2023-04621

BIT-ASPNET-CORE-2023-35391

BIT-DOTNET-2023-35391

BIT-DOTNET-SDK-2023-35391

CVE-2023-35391

GHSA-J8RM-CM55-QQJ6

Affected Products

Alt Linux

Asp.Net Core Signalr

Visual Studio

References · 17

• https://bdu.fstec.ru/vul/2023-04621 · Security Note
• https://osv.dev/vulnerability/BIT-aspnet-core-2023-35391 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-35391 · Security Note
• https://osv.dev/vulnerability/GHSA-j8rm-cm55-qqj6 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35391 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-6278-2 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-dotnet-2023-35391 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-dotnet-sdk-2023-35391 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-04615 · Security Note
• https://osv.dev/vulnerability/CVE-2023-35391 · Vendor Advisory
• https://github.com/dotnet/aspnetcore · Note
• https://github.com/dotnet/aspnetcore/security/advisories/GHSA-j8rm-cm55-qqj6 · Note
• https://github.com/dotnet/announcements/issues/267 · Note
• https://twitter.com/VulmonFeeds/status/1689012779808694272 · Twitter Post
• https://access.redhat.com/security/cve/cve-2023-35390 · Note