PT-2023-7216 · Microsoft+6 · Net+8

Chudypb + 1 · Published 2023-11-14 · Updated 2024-12-13 · CVE-2023-36049

Positive Technologies (AI Summary)

CVSS v2.0

8.0

High

Base vector

AV:N/AC:L/Au:S/C:P/I:C/A:P

Name of the Vulnerable Software and Affected Versions .NET, .NET Framework, and Visual Studio (affected versions not specified)

Description The issue is related to insufficient access restrictions in the Microsoft .NET Framework and Visual Studio, allowing a remote attacker to elevate their privileges. This can affect the system, potentially leading to unauthorized actions. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

RCE

Weakness Enumeration

CWE-20

CWE-264

Related Identifiers

ALSA-2023:7253

ALSA-2023:7254

ALSA-2023:7255

ALSA-2023:7256

ALSA-2023:7257

ALSA-2023:7258

ALT-PU-2024-1066

ALT-PU-2024-1067

ALT-PU-2024-1068

ALT-PU-2024-1069

ALT-PU-2024-16792

ALT-PU-2024-16794

ALT-PU-2024-16796

ALT-PU-2024-16939

ALT-PU-2024-2554

ALT-PU-2024-2556

ALT-PU-2024-2557

ALT-PU-2024-2761

ALT-PU-2024-2763

ALT-PU-2024-2765

ALT-PU-2024-2767

BDU:2023-08244

BIT-DOTNET-2023-36049

BIT-DOTNET-SDK-2023-36049

CESA-2023_7254

CESA-2023_7256

CESA-2023_7258

CVE-2023-36049

GHSA-C3HF-8VGX-72RH

RHSA-2023:7253

RHSA-2023:7254

RHSA-2023:7255

RHSA-2023:7256

RHSA-2023:7257

RHSA-2023:7258

RHSA-2023:7259

RHSA-2023_7253

RHSA-2023_7254

RHSA-2023_7255

RHSA-2023_7256

RHSA-2023_7257

RHSA-2023_7258

RLSA-2023:7256

RLSA-2023:7258

USN-6480-1

ZDI-23-1639

Affected Products

.Net Framework

Alt Linux

Almalinux

Centos

Linuxmint

Net

Red Hat

Ubuntu

Visual Studio

References · 58

• https://zerodayinitiative.com/advisories/ZDI-23-1639 · Security Note
• https://osv.dev/vulnerability/ALSA-2023:7254 · Vendor Advisory
• https://osv.dev/vulnerability/USN-6480-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-36049 · Security Note
• https://ubuntu.com/security/CVE-2023-36558 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2023:7258 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2023-7258.html · Vendor Advisory
• https://osv.dev/vulnerability/BIT-dotnet-2023-36049 · Vendor Advisory
• https://osv.dev/vulnerability/RLSA-2023:7256 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2023:7253 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-36049 · Security Note
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36049 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-08244 · Security Note
• https://osv.dev/vulnerability/CVE-2023-36049 · Vendor Advisory
• https://errata.almalinux.org/9/ALSA-2023-7255.html · Vendor Advisory