MSRC-CVE-2023-36873 — .NET Framework Spoofing Vulnerability

Summary

Impact: Spoofing. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?
Successful exploitation of this vulnerability requires an attacker to create a crafted certificate in order to validate themselves as a trusted source.

Vulnerabilities 1

High 7.4

CVE-2023-36873

.NET Framework Spoofing Vulnerability

.NET Framework Spoofing Vulnerability

Microsoft Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.7.2 Microsoft .NET Framework 3.5 AND 4.8

Aug 8, 2023

Revision history

2023-10-24 #2
In the Security Updates table, added .NET Framework 3.5 and 4.6.2 installed on Windows 10 for 32-bit systems and Windows 10 for x64-based systems; added .NET Framework 3.5 and 4.6.2/4.7./4.7.1/4.7.2 installed on all supported editions of Windows 10 version 1607 and Windows Server 2016 as these versions of .NET Framework are affected by this vulnerability. Microsoft recommends that customers install the August 2023 updates to be fully protected from this vulnerability. Customers whose systems are configured to receive automatic updates do not need to take any further action.
2023-08-08 #1
Information published.

References

CVE-2023-36873 .NET Framework Spoofing Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36873
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
Common Vulnerability Scoring System
https://www.first.org/cvss