Skip to content
OpenAdvisories
High MSRC-CVE-2023-36799 1 CVE

.NET Core and Visual Studio Denial of Service Vulnerability

Published Sep 12, 2023 · Updated Oct 24, 2023 · Revision 3

Vendor: Microsoft

Summary

Impact: Denial of Service. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?
An attacker must send the user a malicious request and convince them to open it.

Security updates
6.0.24 — https://support.microsoft.com/help/5032874
7.0.13 — https://support.microsoft.com/help/5032875
17.2.21 — https://docs.microsoft.com/en-us/visualstudio/releases/2022/release-notes
17.4.13 — https://learn.microsoft.com/en-us/visualstudio/releases/2022/release-notes
7.2.14 — https://github.com/PowerShell/Announcements/issues/49

Vulnerabilities 1

Revision history

  1. #3

    To comprehensively address this vulnerability, Microsoft has released security updates on October 24, 2023 for all affected versions of .NET and Microsoft Visual Studio. Microsoft recommends that customers install the updates to be fully protected from the vulnerability.

  2. #2

    Revised the Security Updates table to include PowerShell 7.2 and PowerShell 7.3 because these versions of PowerShell 7 are affected by this vulnerability. See [https://github.com/PowerShell/Announcements/issues/49](https://github.com/PowerShell/Announcements/issues/49) for more information.

  3. #1

    Information published.

References