Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Visual Studio and .NET Privilege Escalation Risk

CVE-2023-36049 · published 2 years ago
Summary

An attacker can potentially gain elevated permissions on a system using Visual Studio or .NET, allowing them to access sensitive information or make unauthorized changes. This issue affects Visual Studio and .NET applications, posing a risk to sensitive data and system integrity. Update and patch affected software to prevent exploitation.

What to do
  • Update microsoft system.net.requests to version 8.0.0.
  • Update microsoft system.net.requests to version 6.0.25.
  • Update microsoft system.net.requests to version 7.0.14.
  • Update microsoft microsoft visual studio 2022 version 17.2 to version 17.2.22 or later.
  • Update microsoft microsoft visual studio 2022 version 17.4 to version 17.4.14 or later.
  • Update microsoft microsoft visual studio 2022 version 17.7 to version 17.7.7 or later.
  • Update microsoft microsoft visual studio 2022 version 17.6 to version 17.6.10 or later.
  • Update microsoft .net 8.0 to version 8.0.0 or later.
  • Update microsoft .net 6.0 to version 6.0.25 or later.
  • Update microsoft .net 7.0 to version 7.0.14 or later.
  • Update microsoft microsoft .net framework 3.5 and 4.8.1 to version 4.8.9206.0 or later.
  • Update microsoft microsoft .net framework 4.8 to version 4.8.4682.0 or later.
  • Update microsoft microsoft .net framework 3.5 and 4.8 to version 4.8.4682.0 or later.
  • Update microsoft microsoft .net framework 3.5 and 4.7.2 to version 4.7.4076.0 or later.
  • Update microsoft microsoft .net framework 3.5 and 4.6.2/4.7/4.7.1/4.7.2 to version 10.0.14393.6452 or later.
  • Update microsoft microsoft .net framework 4.6.2/4.7/4.7.1/4.7.2 to version 4.7.4076.0 or later.
  • Update microsoft microsoft .net framework 4.6.2 to version 4.7.4076.0 or later.
  • Update microsoft microsoft .net framework 3.5 and 4.6/4.6.2 to version 10.0.10240.20308 or later.
  • Update microsoft microsoft .net framework 2.0 service pack 2 to version 3.0.50727.8975 or later.
  • Update microsoft microsoft .net framework 3.0 service pack 2 to version 3.0.50727.8975 or later.
  • Update microsoft microsoft .net framework 3.5 to version 3.0.50727.8975 or later.
  • Update microsoft microsoft .net framework 3.5.1 to version 3.0.50727.8975 or later.
Affected software
Ecosystem VendorProductAffected versions
nuget microsoft system.net.requests 8.0.0-rc.2.23480.2
>= 6.0.0, <= 6.0.24
>= 7.0.0, <= 7.0.13
Fix: upgrade to 8.0.0
– microsoft .net_framework 2.0
3.0
3.5
4.6.2
4.7
4.7.1
4.7.2
4.8
4.8.1
3.5.1
cpe:2.3:a:microsoft:.net_framework:2.0:sp2:*:*:*:*:*:*
– microsoft .net >= 6.0.0, < 6.0.25
>= 7.0.0, < 7.0.14
8.0.0
cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*
– microsoft visual_studio_2022 >= 17.2, < 17.2.22
>= 17.4, < 17.4.14
>= 17.6, < 17.6.10
>= 17.7, < 17.7.7
cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*
– microsoft microsoft visual studio 2022 version 17.2 < 17.2.22
– microsoft microsoft visual studio 2022 version 17.4 < 17.4.14
– microsoft microsoft visual studio 2022 version 17.7 < 17.7.7
– microsoft microsoft visual studio 2022 version 17.6 < 17.6.10
– microsoft .net 8.0 < 8.0.0
– microsoft .net 6.0 < 6.0.25
– microsoft .net 7.0 < 7.0.14
– microsoft microsoft .net framework 3.5 and 4.8.1 < 4.8.9206.0
– microsoft microsoft .net framework 4.8 < 4.8.4682.0
– microsoft microsoft .net framework 3.5 and 4.8 < 4.8.4682.0
– microsoft microsoft .net framework 3.5 and 4.7.2 < 4.7.4076.0
– microsoft microsoft .net framework 3.5 and 4.6.2/4.7/4.7.1/4.7.2 < 10.0.14393.6452
– microsoft microsoft .net framework 4.6.2/4.7/4.7.1/4.7.2 < 4.7.4076.0
– microsoft microsoft .net framework 4.6.2 < 4.7.4076.0
– microsoft microsoft .net framework 3.5 and 4.6/4.6.2 < 10.0.10240.20308
– microsoft microsoft .net framework 2.0 service pack 2 < 3.0.50727.8975
– microsoft microsoft .net framework 3.0 service pack 2 < 3.0.50727.8975
– microsoft microsoft .net framework 3.5 < 3.0.50727.8975
– microsoft microsoft .net framework 3.5.1 < 3.0.50727.8975
Original advisory text
.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability
.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
9.8 Critical
Exploitation
7% chance of attack within 30 days
Type
CWE-20Improper Input Validation
Timeline
Published14 Nov 2023
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-c3hf-8vgx-72rh · GHSA
CVE-2023-36049 · NVD
CVE-2023-36049 · MITRE
CVE-2023-36049 · OSV
Track software like this
Free during beta