Skip to content
OpenAdvisories
High MSRC-CVE-2023-33127 1 CVE

.NET and Visual Studio Elevation of Privilege Vulnerability

Published Jul 11, 2023 · Updated Jul 14, 2023 · Revision 2

Vendor: Microsoft

Summary

Impact: Elevation of Privilege. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

What privileges could be gained by an attacker who successfully exploited the vulnerability?
The attacker would gain the rights of the user that is running the affected application.

According to the CVSS metric, the attack vector is network (AV:N). How could an attacker exploit this vulnerability?
An attacker could exploit this vulnerability by abusing the .NET diagnostics server to gain elevation of privileges.

According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?
Successful exploitation of this vulnerability requires an attacker to win a race condition and also to take additional actions prior to exploitation to prepare the target environment.

Security updates
6.0.20 — https://support.microsoft.com/help/5028705
7.0.9 — https://support.microsoft.com/help/5028706
17.0.23 — https://docs.microsoft.com/en-us/visualstudio/releases/2022/release-notes-v17.0
17.2.17 — https://docs.microsoft.com/en-us/visualstudio/releases/2022/release-notes
17.4.9 — https://learn.microsoft.com/en-us/visualstudio/releases/2022/release-notes
7.2.13 — https://github.com/PowerShell/Announcements/issues/48

Vulnerabilities 1

Revision history

  1. #2

    Revised the Security Updates table to include PowerShell 7.2 and PowerShell 7.3 because these versions of PowerShell 7 are affected by this vulnerability. See [https://github.com/PowerShell/Announcements/issues/48](https://github.com/PowerShell/Announcements/issues/48) for more information.

  2. #1

    Information published.

References