Skip to content
OpenAdvisories
High MSRC-CVE-2023-21722 1 CVE

.NET Framework Denial of Service Vulnerability

Published Feb 14, 2023 · Updated Mar 29, 2023 · Revision 3

Summary

Impact: Denial of Service. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

According to the CVSS metric, privileges required is low (PR:L). What does that mean for this vulnerability?
Any authenticated attacker could trigger this vulnerability. It does not require admin or other elevated privileges.

According to the CVSS metric, the attack vector is local (AV:L). Why does the CVE title indicate that this is Denial of Service?
The attack itself is carried out locally. For example, when the score indicates that the Attack Vector is Local and User Interaction is Required, this could describe an exploit in which an attacker, through social engineering, convinces a victim to download and open a specially crafted file from a website. This could lead to a local attack on the victim's computer which could cause a denial of service.

Security updates
4.8.4614.08 — https://support.microsoft.com/help/5022731
4.8.4614.07 — https://support.microsoft.com/help/5022783
4.8.04614.05 — https://support.microsoft.com/help/5022732
4.8.04614.03 — https://support.microsoft.com/help/5022784
4.8.04614.05 — https://support.microsoft.com/help/5022733
4.8.04614.03 — https://support.microsoft.com/help/5022785
10.0.04614.06 — https://support.microsoft.com/help/5022782
10.0.04614.06 — https://support.microsoft.com/help/5022735
10.0.04614.06 — https://support.microsoft.com/help/5022727
10.0.4614.06 — https://support.microsoft.com/help/5022730
10.0.04614.06 — https://support.microsoft.com/help/5022728
10.0.09139.02 — https://support.microsoft.com/help/5022497
10.0.09139.02 — https://support.microsoft.com/help/5022729
4.7.04038.06 — https://support.microsoft.com/help/5022734
4.7.4038.05 — https://support.microsoft.com/help/5022786
10.0.10240.19747 — https://support.microsoft.com/help/5022858
10.0.14393.5717 — https://support.microsoft.com/help/5022838
10.0.04614.05 — https://support.microsoft.com/help/5022503

Vulnerabilities 1

Revision history

  1. #3

    Microsoft has rereleased KB5022498 to address a known issue where customers who installed the .NET Framework 4.8 February cumulative update (KB5022502), then updgraded to .NET Framework 4.8.1 and subsequently scanned for updates were unable to install KB5022498. Customers who were unable to install KB5022498 should rescan for updates and install the update. Customers who have already successfully installed KB5022498 do not need to take any further action.

  2. #2

    Updated one or more CVSS scores for the affected products. This is an informational change only.

  3. #1

    Information published.

References