MSRC-CVE-2023-36560 — ASP.NET Security Feature Bypass Vulnerability

Summary

Impact: Security Feature Bypass. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

What kind of security feature could be bypassed by successfully exploiting this vulnerability?
The attacker would be able to bypass the security checks that prevents an attacker from accessing internal applications in a website.

How could an attacker exploit this vulnerability?
The attacker could send a specially crafted request that would enable them to access parts of a web application that they would not normally have access to.

Vulnerabilities 1

High 8.8

CVE-2023-36560

ASP.NET Security Feature Bypass Vulnerability

ASP.NET Security Feature Bypass Vulnerability

Microsoft Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Microsoft .NET Framework 3.5 AND 4.7.2

Nov 14, 2023

Revision history

2023-11-17 #2
Updated the build numbers. This is an informational update only.
2023-11-14 #1
Information published.

References

CVE-2023-36560 ASP.NET Security Feature Bypass Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36560
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
Common Vulnerability Scoring System
https://www.first.org/cvss