Skip to content
OpenAdvisories
High MSRC-CVE-2023-36899 1 CVE

ASP.NET Elevation of Privilege Vulnerability

Published Aug 8, 2023 · Updated Oct 26, 2023 · Revision 4

Vendor: Microsoft

Summary

Impact: Elevation of Privilege. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

What privileges could be gained by an attacker who successfully exploited the vulnerability?
The attacker would gain the rights of the user that is running the affected application.

According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?
The target environment could be accidentally configured to allow the vulnerability.

Security updates
4.8.4654.06 — https://support.microsoft.com/help/5029651
4.8.04654.05 — https://support.microsoft.com/help/5029566
4.8.04654.06 — https://support.microsoft.com/help/5029652
4.8.04654.05 — https://support.microsoft.com/help/5029567
4.8.04654.08 — https://support.microsoft.com/help/5029653
4.8.04654.07 — https://support.microsoft.com/help/5029568
4.8.04654.06 — https://support.microsoft.com/help/5029648
4.8.04654.06 — https://support.microsoft.com/help/5029649
10.0.14393.6167 — https://support.microsoft.com/help/5029242
4.8.09176.01 — https://support.microsoft.com/help/5029650
4.8.09176.01 — https://support.microsoft.com/help/5028948
4.8.04654.06 — https://support.microsoft.com/help/5028952
4.8.04654.08 — https://support.microsoft.com/help/5029647
4.8.04654.06 — https://support.microsoft.com/help/5029655
4.7.04057.05 — https://support.microsoft.com/help/5029654
4.7.4057.04 — https://support.microsoft.com/help/5029569
10.0.10240.20107 — https://support.microsoft.com/help/5029259

Vulnerabilities 1

Revision history

  1. #4

    Updated one or more CVSS scores for the affected products. This is an informational change only.

  2. #3

    In the Security Updates table, added .NET Framework 3.5 and 4.6.2 installed on Windows 10 for 32-bit systems and Windows 10 for x64-based systems; added .NET Framework 3.5 and 4.6.2/4.7./4.7.1/4.7.2 installed on all supported editions of Windows 10 version 1607 and Windows Server 2016 as these versions of .NET Framework are affected by this vulnerability. Microsoft recommends that customers install the August 2023 updates to be fully protected from this vulnerability. Customers whose systems are configured to receive automatic updates do not need to take any further action.

  3. #2

    Updated one or more CVSS scores for the affected products. This is an informational change only.

  4. #1

    Information published.

References