Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
kasperskyKaspersky LabKLA50317
HistoryJun 13, 2023 - 12:00 a.m.

KLA50317 Multiple vulnerabilities in Microsoft Developer Tools

2023-06-1300:00:00
Kaspersky Lab
threats.kaspersky.com
49

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

8.8 High

AI Score

Confidence

Low

6 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:S/C:P/I:P/A:P

0 Low

EPSS

Percentile

14.0%

JSON

Detect date:

06/13/2023

Severity:

Critical

Description:

Multiple vulnerabilities were found in Microsoft Developer Tools. Malicious users can exploit these vulnerabilities to cause denial of service, gain privileges, execute arbitrary code, bypass security restrictions, obtain sensitive information, spoof user interface.

Exploitation:

Public exploits exist for this vulnerability.

Affected products:

NuGet 6.3.2
Microsoft Visual Studio 2013 Update 5
Microsoft Visual Studio 2015 Update 3
Microsoft .NET Framework 3.5 AND 4.8
Microsoft .NET Framework 3.5 AND 4.8.1
Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2
Microsoft Visual Studio 2022 version 17.5
NuGet 6.0.4
Microsoft .NET Framework 3.5 and 4.6.2
Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2
Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)
NuGet 6.4.1
Microsoft .NET Framework 4.8
Azure DevOps Server 2020.1.2
.NET 6.0
Microsoft Visual Studio 2022 version 17.0
NuGet 6.2.3
Microsoft .NET Framework 4.6.2
Microsoft Visual Studio 2022 version 17.2
Microsoft .NET Framework 2.0 Service Pack 2
YARP 2.0
Microsoft .NET Framework 3.0 Service Pack 2
Windows Sysinternals Process Monitor
NuGet 6.5.0
Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10)
Microsoft Visual Studio 2022 version 17.6
Microsoft .NET Framework 3.5.1
Microsoft .NET Framework 3.5
Microsoft .NET Framework 3.5 AND 4.7.2
NuGet 6.6.0
Sysinternals Suite
Microsoft Visual Studio 2022 version 17.4
.NET 7.0
Visual Studio Code

Solution:

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Original advisories:

CVE-2023-29007
CVE-2023-33139
CVE-2023-24936
CVE-2023-27909
CVE-2023-32030
CVE-2023-32032
CVE-2023-25815
CVE-2023-24895
CVE-2023-24897
CVE-2023-33126
CVE-2023-29011
CVE-2023-21565
CVE-2023-29326
CVE-2023-33144
CVE-2023-33135
CVE-2023-27910
CVE-2023-29337
CVE-2023-33141
CVE-2023-29353
CVE-2023-25652
CVE-2023-29331
CVE-2023-27911
CVE-2023-33128
CVE-2023-21569
CVE-2023-29012

Impacts:

ACE

Related products:

Microsoft .NET Framework

CVE-IDS:

CVE-2023-258152.2Warning
CVE-2023-290077.8Critical
CVE-2023-256527.5Critical
CVE-2023-290127.8Critical
CVE-2023-290117.8Critical
CVE-2023-331395.5High
CVE-2023-249367.5Critical
CVE-2023-279097.8Critical
CVE-2023-320307.5Critical
CVE-2023-320326.5High
CVE-2023-248957.8Critical
CVE-2023-248977.8Critical
CVE-2023-331267.3High
CVE-2023-215657.1High
CVE-2023-293267.8Critical
CVE-2023-331446.6High
CVE-2023-331357.3High
CVE-2023-279107.8Critical
CVE-2023-293377.1High
CVE-2023-331417.5Critical
CVE-2023-293535.5High
CVE-2023-293317.5Critical
CVE-2023-279117.8Critical
CVE-2023-331287.3High
CVE-2023-215695.5High

KB list:

5027230
5027219
5026454
5027798
5027533
5027539
5027532
5025792
5027119
5026455
5027797
5027540
5027123
5026610
5027537
5027534
5027544
5027543
5027536
5027531
5027541
5027538
5027542

Microsoft official advisories:

References

Related

mskb 20
openvas 25
nessus 59
kaspersky 3
redhat 20
osv 14
ubuntu 4
github 3
oraclelinux 7
rocky 3
almalinux 6
ibm 1
ics 1
slackware 1
cloudfoundry 1
fedora 3
mageia 1
altlinux 1
avleonov 1
cloudlinux 1
rosalinux 1
redos 1
centos 1
freebsd 2
amazon 1
mscve 7
prion 5
rapid7blog 1
cve 3
alpinelinux 1
veracode 1
mskb
mskb
.NET 7.0 Update - June 13, 2023 (KB5027798)
2023-06-13 07:00:00
June 13, 2023-Security Only Update for .NET Framework 3.5.1, 4.6.2, 4.7, 4.7.1, 4.7.2, 4.8 for Windows Embedded 7 Standard and Windows Server 2008 R2 SP1 (KB5027531)
2023-06-13 07:00:00
June 13, 2023-KB5027538 Cumulative Update for .NET Framework 3.5, 4.8 and 4.8.1 for Windows 10 Version 22H2
2023-06-13 07:00:00
openvas
openvas
.NET Core Multiple Vulnerabilities - Windows
2023-06-14 00:00:00
Ubuntu: Security Advisory (USN-6161-1)
2023-06-14 00:00:00
Ubuntu: Security Advisory (USN-6161-2)
2023-06-26 00:00:00
nessus
nessus
Security Updates for Microsoft Visual Studio Products (June 2023)
2023-06-13 00:00:00
RHEL 9 : .NET 7.0 (RHSA-2023:3592)
2023-06-14 00:00:00
Rocky Linux 8 : .NET 7.0 (RLSA-2023:3593)
2023-08-31 00:00:00
kaspersky
kaspersky
KLA49048 Multiple vulnerabilities in Git for Windows
2023-04-25 00:00:00
KLA50322 Multiple vulnerabilities in Microsoft Azure
2023-06-13 00:00:00
KLA60730 Multiple vulnerabilities in Microsoft Apps
2023-06-13 00:00:00
redhat
redhat
(RHSA-2023:3593) Important: .NET 7.0 security, bug fix, and enhancement update
2023-06-14 08:49:47
(RHSA-2023:3592) Important: .NET 7.0 security, bug fix, and enhancement update
2023-06-14 08:48:07
(RHSA-2023:3581) Important: .NET 6.0 security, bug fix, and enhancement update
2023-06-14 07:26:00
osv
osv
dotnet6, dotnet7 regression
2023-06-23 11:39:01
Important: .NET 7.0 security, bug fix, and enhancement update
2023-08-31 16:54:34
Important: .NET 7.0 security, bug fix, and enhancement update
2023-06-14 00:00:00
ubuntu
ubuntu
.NET vulnerabilities
2023-06-13 00:00:00
.NET regression
2023-06-23 00:00:00
Git vulnerabilities
2023-05-01 00:00:00
github
github
Git security vulnerabilities announced
2023-04-25 17:13:36
YARP Denial of Service Vulnerability
2023-06-23 21:37:26
Microsoft Security Advisory CVE-2023-33126: .NET Remote Code Execution Vulnerability
2023-06-14 17:18:10
oraclelinux
oraclelinux
.NET 7.0 security, bug fix, and enhancement update
2023-06-17 00:00:00
.NET 7.0 security, bug fix, and enhancement update
2023-06-17 00:00:00
.NET 6.0 security, bug fix, and enhancement update
2023-06-16 00:00:00
rocky
rocky
.NET 7.0 security, bug fix, and enhancement update
2023-08-31 16:54:34
.NET 6.0 security, bug fix, and enhancement update
2023-08-31 16:54:34
git security update
2023-05-25 02:36:20
almalinux
almalinux
Important: .NET 7.0 security, bug fix, and enhancement update
2023-06-14 00:00:00
Important: .NET 7.0 security, bug fix, and enhancement update
2023-06-14 00:00:00
Important: .NET 6.0 security, bug fix, and enhancement update
2023-06-14 00:00:00
ibm
ibm
Security Bulletin: Multiple security vulnerabilities in .NET may affect IBM Robotic Process Automation for Cloud Pak (CVE-2023-24936, CVE-2023-29337, CVE-2023-33128)
2023-08-22 03:25:09
ics
ics
Siemens PNI
2023-11-16 12:00:00
slackware
slackware
[slackware-security] git
2023-04-25 21:30:49
cloudfoundry
cloudfoundry
USN-6050-1: Git vulnerabilities | Cloud Foundry
2023-06-30 00:00:00
fedora
fedora
[SECURITY] Fedora 36 Update: git-2.40.1-1.fc36
2023-05-12 02:08:45
[SECURITY] Fedora 38 Update: git-2.40.1-1.fc38
2023-04-28 02:38:56
[SECURITY] Fedora 37 Update: git-2.40.1-1.fc37
2023-05-01 01:29:35
mageia
mageia
Updated git packages fix security vulnerability
2023-05-06 21:19:07
altlinux
altlinux
Security fix for the ALT Linux 10 package git version 2.33.8-alt1
2023-05-02 00:00:00
avleonov
avleonov
Microsoft Patch Tuesday June 2023: Edge type confusion, Git RCE, OneNote Spoofing, PGM RCE, Exchange RCE, SharePoint EoP
2023-06-25 00:35:58
cloudlinux
cloudlinux
git: Fix of 2 CVEs
2023-05-11 14:15:13
rosalinux
rosalinux
Advisory ROSA-SA-2023-2176
2023-06-27 09:16:21
redos
redos
ROS-20230824-02
2023-08-24 00:00:00
centos
centos
emacs, git, gitk, gitweb, perl security update
2023-07-27 14:38:52
freebsd
freebsd
git -- Multiple vulnerabilities
2023-04-25 00:00:00
vscode -- VS Code Information Disclosure Vulnerability
2023-06-13 00:00:00
amazon
amazon
Medium: git
2023-06-05 16:39:00
mscve
mscve
Sysinternals Process Monitor for Windows Denial of Service Vulnerability
2023-06-13 07:00:00
Yet Another Reverse Proxy (YARP) Denial of Service Vulnerability
2023-06-13 07:00:00
Azure DevOps Server Spoofing Vulnerability
2023-06-13 07:00:00
prion
prion
Spoofing
2023-06-14 00:15:00
Denial of service
2023-06-14 00:15:00
Design/Logic Flaw
2023-04-25 21:15:00
rapid7blog
rapid7blog
Patch Tuesday - June 2023
2023-06-13 20:49:27
cve
cve
CVE-2023-32030
2023-06-14 15:15:09
CVE-2023-21565
2023-06-14 00:15:09
CVE-2023-33141
2023-06-23 02:15:09
alpinelinux
alpinelinux
CVE-2023-33135
2023-06-14 00:15:12
veracode
veracode
Denial Of Service (DoS)
2023-06-27 08:26:21

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

8.8 High

AI Score

Confidence

Low

6 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:S/C:P/I:P/A:P

0 Low

EPSS

Percentile

14.0%

JSON
Related for KLA50317
mskb20openvas25nessus59kaspersky3redhat20osv14ubuntu4github3oraclelinux7rocky3almalinux6ibm1ics1slackware1cloudfoundry1fedora3mageia1altlinux1avleonov1cloudlinux1rosalinux1redos1centos1freebsd2amazon1mscve7prion5rapid7blog1cve3alpinelinux1veracode1