CVE-2023-36049: .NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• microsoft .net6.0.0 and later · before 6.0.25
• microsoft .net7.0.0 and later · before 7.0.14
• microsoft .net8.0.0
• microsoft .net framework2.0
• microsoft .net framework3.0
• microsoft .net framework3.5
• microsoft .net framework3.5.1
• microsoft .net framework4.6.2
• microsoft .net framework4.7
• microsoft .net framework4.7.1
• microsoft .net framework4.7.2
• microsoft .net framework4.8
• microsoft .net framework4.8.1
• microsoft visual studio 202217.2 and later · before 17.2.22
• microsoft visual studio 202217.4 and later · before 17.4.14
• microsoft visual studio 202217.6 and later · before 17.6.10
• microsoft visual studio 202217.7 and later · before 17.7.7

Versions reported by the vendor

Affected version ranges reported by the assigning authority (microsoft). Independent of NVD's CPE analysis and usually ahead of it.

• Microsoft .NET 6.0

  • 6.0.0 and later · before 6.0.25affected

• Microsoft .NET 7.0

  • 7.0.0 and later · before 7.0.14affected

• Microsoft .NET 8.0

  • 8.0 and later · before 8.0.0affected

• Microsoft Microsoft .NET Framework 2.0 Service Pack 2

  • 2.0.0 and later · before 3.0.50727.8975affected

• Microsoft Microsoft .NET Framework 3.0 Service Pack 2

  • 3.0.0 and later · before 3.0.50727.8975affected

• Microsoft Microsoft .NET Framework 3.5

  • 3.5.0 and later · before 3.0.50727.8975affected

• Microsoft Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2

  • 3.0.0.0 and later · before 10.0.14393.6452affected

• Microsoft Microsoft .NET Framework 3.5 AND 4.6/4.6.2

  • 10.0.0 and later · before 10.0.10240.20308affected

• Microsoft Microsoft .NET Framework 3.5 AND 4.7.2

  • 4.7.0 and later · before 4.7.4076.0affected

• Microsoft Microsoft .NET Framework 3.5 AND 4.8

  • 4.8.0 and later · before 4.8.4682.0affected

• Microsoft Microsoft .NET Framework 3.5 AND 4.8.1

  • 4.8.1 and later · before 4.8.9206.0affected

• Microsoft Microsoft .NET Framework 3.5.1

  • 3.5.0 and later · before 3.0.50727.8975affected

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2020-0646A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka '.NET Framework Remote KEV
  99Now
• CVE-2024-29059.NET Framework Information Disclosure VulnerabilityKEV
  90Now
• CVE-2017-8759Microsoft .NET Framework 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7 allow an attacker to execute code remotely via a malicious documeKEV
  88Now

Published before and after this one in the same product

• ← EarlierCVE-2023-36796Sep 12, 2023 · Visual Studio Remote Code Execution Vulnerability
  31Monitor
• ← EarlierCVE-2023-36560Nov 14, 2023 · ASP.NET Security Feature Bypass Vulnerability
  36Monitor
• Later →CVE-2024-21312Jan 9, 2024 · .NET Framework Denial of Service Vulnerability
  31Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.