Skip to content
OpenAdvisories
Medium MSRC-CVE-2023-24936 1 CVE

.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability

Published Jun 13, 2023 · Updated Sep 12, 2023 · Revision 5

Vendor: Microsoft

Summary

Impact: Elevation of Privilege. Microsoft rating: Moderate. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

What privileges could be gained by an attacker who successfully exploited the vulnerability?
An attacker who successfully exploited this vulnerability could gain administrator privileges.

According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?
Successful exploitation of this vulnerability requires an attacker to prepare the target environment to improve exploit reliability.

How could an attacker exploit this vulnerability?
An attacker could exploit this vulnerability by tricking a user into opening a malicious XML file.

Security updates
17.2.16 — https://docs.microsoft.com/en-us/visualstudio/releases/2022/release-notes
17.0.22 — https://docs.microsoft.com/en-us/visualstudio/releases/2022/release-notes-v17.0
17.4.8 — https://learn.microsoft.com/en-us/visualstudio/releases/2022/release-notes
6.0.18 — https://support.microsoft.com/help/5027797
7.0.7 — https://support.microsoft.com/help/5027798
7.2.12 — https://github.com/PowerShell/Announcements/issues/42
4.8.4644.0 — https://support.microsoft.com/help/5027123
4.8.4644.0 — https://support.microsoft.com/help/5027542
4.8.4644.0 — https://support.microsoft.com/help/5027533
4.8.4644.0 — https://support.microsoft.com/help/5027536
4.8.4644.0 — https://support.microsoft.com/help/5027541
4.8.4644.0 — https://support.microsoft.com/help/5027532
4.8.4644.0 — https://support.microsoft.com/help/5027540
4.8.4644.0 — https://support.microsoft.com/help/5027531
4.8.4644.0 — https://support.microsoft.com/help/5027544
4.8.4644.0 — https://support.microsoft.com/help/5027539
4.8.4644.0 — https://support.microsoft.com/help/5027538
4.8.4644.0 — https://support.microsoft.com/help/5027537
10.0.14393.5989 — https://support.microsoft.com/help/5027219
4.7.04043.0 — https://support.microsoft.com/help/5027543
4.7.4050.0 — https://support.microsoft.com/help/5027534
4.8.9166.0 — https://support.microsoft.com/help/5027119
10.0.10240.19983 — https://support.microsoft.com/help/5027230

Vulnerabilities 1

Revision history

  1. #5

    Updated links to security updates. This is an informational change only.

  2. #4

    Updated one or more CVSS scores for the affected products. This is an informational change only.

  3. #3

    In the Security Updates table, added all supported versions of all supported versions of .NET Framework, Visual Studio 2022 version 17.0, Visual Studio 2022 version 17.2, and Visual Studio 2022 version 17.4 because these products are also affected by this vulnerability. Microsoft strongly recommends that customers running any of these products install the updates to be fully protected from the vulnerability. Customers whose systems are configured to receive automatic updates do not need to take any further action.

  4. #2

    Revised the Security Updates table to include PowerShell 7.2 and PowerShell 7.3 because these versions of PowerShell 7 are affected by this vulnerability. See [https://github.com/PowerShell/Announcements/issues/42](https://github.com/PowerShell/Announcements/issues/42) for more information.

  5. #1

    Information published.

References