CVE-2023-36792

EPSS 0.95%
Published 12.09.2023 17:15:14
Last modified 21.11.2024 08:10:36
Source secure@microsoft.com
Teams watchlist Login
Open Login

Visual Studio Remote Code Execution Vulnerability

Affected products Warnungen 0 Metrics 2 CWE 1 References 4

Data is provided by the National Vulnerability Database (NVD)

Microsoft ≫ .Net Framework Version3.5.1

Microsoft ≫ Windows Server 2008 Versionr2 Updatesp1 HwPlatformx64

Microsoft ≫ .Net Framework Version3.5

Microsoft ≫ Windows Server 2012 Versionr2

Microsoft ≫ .Net Framework Version2.0 Updatesp2

Microsoft ≫ Windows Server 2008 Version- Updatesp2

Microsoft ≫ .Net Framework Version3.0 Updatesp2

Microsoft ≫ Windows Server 2008 Version- Updatesp2

Microsoft ≫ .Net Framework Version4.6.2

Microsoft ≫ Windows Server 2008 Version- Updatesp2

Microsoft ≫ .Net Framework Version3.5

   Microsoft ≫ Windows 10 1809 Version-
   Microsoft ≫ Windows 10 21h2 Version-
   Microsoft ≫ Windows 10 22h2 Version-
   Microsoft ≫ Windows 11 21h2 Version-
   Microsoft ≫ Windows Server 2019 Version-
   Microsoft ≫ Windows Server 2022 Version-

Microsoft ≫ .Net Framework Version4.8

Microsoft ≫ .Net Framework Version3.5

   Microsoft ≫ Windows 10 21h2 Version-
   Microsoft ≫ Windows 10 22h2 Version-
   Microsoft ≫ Windows 11 21h2 Version-
   Microsoft ≫ Windows 11 22h2 Version-
   Microsoft ≫ Windows Server 2022 Version-

Microsoft ≫ .Net Framework Version4.8.1

Microsoft ≫ .Net Framework Version4.8

   Microsoft ≫ Windows 10 1607 Version-
   Microsoft ≫ Windows Server 2008 Versionr2 Updatesp1 HwPlatformx64
   Microsoft ≫ Windows Server 2012 Version-
   Microsoft ≫ Windows Server 2012 Versionr2
   Microsoft ≫ Windows Server 2016 Version-

Microsoft ≫ .Net Framework Version3.5

Microsoft ≫ Windows 10 1809 Version-
Microsoft ≫ Windows Server 2019 Version-

Microsoft ≫ .Net Framework Version4.7.2

Microsoft ≫ Windows 10 1809 Version-
Microsoft ≫ Windows Server 2019 Version-

Microsoft ≫ .Net Framework Version4.6.2

   Microsoft ≫ Windows Server 2008 Versionr2 Updatesp1 HwPlatformx64
   Microsoft ≫ Windows Server 2012 Version-
   Microsoft ≫ Windows Server 2012 Versionr2

Microsoft ≫ .Net Framework Version4.7

   Microsoft ≫ Windows Server 2008 Versionr2 Updatesp1 HwPlatformx64
   Microsoft ≫ Windows Server 2012 Version-
   Microsoft ≫ Windows Server 2012 Versionr2

Microsoft ≫ .Net Framework Version4.7.1

   Microsoft ≫ Windows Server 2008 Versionr2 Updatesp1 HwPlatformx64
   Microsoft ≫ Windows Server 2012 Version-
   Microsoft ≫ Windows Server 2012 Versionr2

Microsoft ≫ .Net Framework Version4.7.2

   Microsoft ≫ Windows Server 2008 Versionr2 Updatesp1 HwPlatformx64
   Microsoft ≫ Windows Server 2012 Version-
   Microsoft ≫ Windows Server 2012 Versionr2

Microsoft ≫ .Net Version6.0.0 Update-

Microsoft ≫ .Net Version7.0.0

Microsoft ≫ Visual Studio 2017 Version >= 15.0 < 15.9.57

Microsoft ≫ Visual Studio 2019 Version >= 16.0 < 16.11.30

Microsoft ≫ Visual Studio 2022 Version >= 17.2 < 17.2.19

Microsoft ≫ Visual Studio 2022 Version >= 17.4 < 17.4.11

Microsoft ≫ Visual Studio 2022 Version >= 17.7 < 17.7.4

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.95%	0.756

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
secure@microsoft.com	7.8	1.8	5.9	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE-190 Integer Overflow or Wraparound

The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36792

Patch

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2023-36792

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2023-36792

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2023-36792

EUVD