PT-2024-5361 · Microsoft+2 · Net+4

Goodbyeselene · Published 2024-07-09 · Updated 2025-05-16 · CVE-2024-38081

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions .NET, .NET Framework, and Visual Studio (affected versions not specified)

Description The issue is related to an elevation-of-privilege vulnerability in .NET, .NET Framework, and Visual Studio. It is caused by incorrect handling of symbolic links before accessing a file. Exploitation of this issue may allow an attacker to elevate their privileges.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

DoS

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

ALT-PU-2024-16742

ALT-PU-2024-16744

ALT-PU-2024-16792

ALT-PU-2024-16794

BDU:2024-05994

BIT-DOTNET-2024-38081

BIT-DOTNET-SDK-2024-38081

CVE-2024-38081

GHSA-HQ7W-XV5X-G34J

Affected Products

.Net Framework

Alt Linux

Net

Red Os

Visual Studio

References · 23

• https://cve.org/CVERecord?id=CVE-2024-38081 · Security Note
• https://osv.dev/vulnerability/BIT-dotnet-2024-38081 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2024-38081 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-05994 · Security Note
• https://osv.dev/vulnerability/GHSA-hq7w-xv5x-g34j · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-38081 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38081 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-38081 · Security Note
• https://osv.dev/vulnerability/BIT-dotnet-sdk-2024-38081 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-38081 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-38081 · Security Note
• https://osv.dev/vulnerability/CVE-2024-38081 · Vendor Advisory
• https://github.com/dotnet/runtime · Note
• https://github.com/dotnet/runtime/security/advisories/GHSA-hq7w-xv5x-g34j · Note