PT-2023-5046 · Microsoft · .Net Framework+1

Published 2023-09-12 · Updated 2023-09-19 · CVE-2023-36788

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions .NET Framework (affected versions not specified)

Description The issue is related to insufficient input validation in the .NET Framework, which can be exploited to execute arbitrary code. This can allow an attacker to run remote code execution attacks. The vulnerability is also associated with an unsandboxed parser in the Windows Presentation Foundation (WPF) XAML parser, which can lead to remote code execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2023-05590

CVE-2023-36788

Affected Products

.Net Framework

Windows Presentation Foundation

References · 11

• https://cve.org/CVERecord?id=CVE-2023-36788 · Security Note
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36788 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-36788 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-36788 · Security Note
• https://bdu.fstec.ru/vul/2023-05590 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-36788 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-36788 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/698512 · Security Note
• https://ubuntu.com/security/CVE-2023-36788 · Vendor Advisory
• https://t.me/cibsecurity/70310 · Telegram Post
• https://twitter.com/IMilcinoski/status/1704139088402456590 · Twitter Post