Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
kasperskyKaspersky LabKLA60561
HistorySep 12, 2023 - 12:00 a.m.

KLA60561 Multiple vulnerabilities in Microsoft Developer Tools

2023-09-1200:00:00
Kaspersky Lab
threats.kaspersky.com
75

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

8.7 High

AI Score

Confidence

High

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.017 Low

EPSS

Percentile

87.6%

JSON

Detect date:

09/12/2023

Severity:

Critical

Description:

Multiple vulnerabilities were found in Microsoft Developer Tools. Malicious users can exploit these vulnerabilities to execute arbitrary code, gain privileges, cause denial of service.

Affected products:

Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)
Microsoft Visual Studio 2022 version 17.4
Microsoft Visual Studio 2022 version 17.7
.NET 6.0
Microsoft .NET Framework 4.8
Azure DevOps Server 2020.1.2
Microsoft .NET Framework 3.5
Microsoft .NET Framework 3.5 AND 4.8
Azure DevOps Server 2019.0.1
Microsoft .NET Framework 3.5 AND 4.8.1
Microsoft .NET Framework 2.0 Service Pack 2
Azure DevOps Server 2019.1.2
Visual Studio Code
Microsoft .NET Framework 3.5 AND 4.7.2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 4.6.2
Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10)
Microsoft Visual Studio 2022 version 17.6
.NET 7.0
Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2
Microsoft Visual Studio 2022 version 17.2
Azure DevOps Server 2020.0.2
Microsoft .NET Framework 3.5.1

Solution:

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Original advisories:

CVE-2023-36793
CVE-2023-36796
CVE-2023-36788
CVE-2023-36742
CVE-2023-36792
CVE-2023-39956
CVE-2023-38155
CVE-2023-33136
CVE-2023-36759
CVE-2023-36799
CVE-2023-36794
CVE-2023-36758

Impacts:

ACE

Related products:

Microsoft .NET Framework

CVE-IDS:

CVE-2023-399566.6High
CVE-2023-367937.8Critical
CVE-2023-367967.8Critical
CVE-2023-367887.8Critical
CVE-2023-367427.8Critical
CVE-2023-367927.8Critical
CVE-2023-381558.1Critical
CVE-2023-331368.8Critical
CVE-2023-367596.7High
CVE-2023-367996.5High
CVE-2023-367947.8Critical
CVE-2023-367589.8Critical

KB list:

5030184
5030179
5029924
5030180
5030183
5030181
5030185
5030182
5030186
5030178
5030213
5030220
5031217
5029366
5029365
5032875
5032874

Microsoft official advisories:

References

Related

openvas 10
nessus 40
mskb 23
github 6
osv 31
talosblog 1
prion 12
mscve 12
kaspersky 1
cve 12
zdi 1
cnvd 1
freebsd 1
ubuntucve 6
redhatcve 6
alpinelinux 4
veracode 5
redhat 7
almalinux 8
oraclelinux 8
rocky 2
ubuntu 2
openvas
openvas
Microsoft Visual Studio Multiple Vulnerabilities-01 (Sep 2023)
2023-09-14 00:00:00
Microsoft Visual Studio Multiple Vulnerabilities-02 (Sep 2023)
2023-09-14 00:00:00
Microsoft .NET Framework Multiple Vulnerabilities (KB5030181)
2023-09-13 00:00:00
nessus
nessus
Security Updates for Microsoft Visual Studio Products (September 2023)
2023-09-12 00:00:00
Security Updates for Microsoft .NET Framework (September 2023)
2023-09-13 00:00:00
Amazon Linux 2023 : aspnetcore-runtime-6.0, aspnetcore-targeting-pack-6.0, dotnet (ALAS2023-2023-369)
2023-10-03 00:00:00
mskb
mskb
September 12, 2023-Security and Quality Rollup for .NET Framework 3.5, 4.6.2, 4.7, 4.7.1, 4.7.2, 4.8 for Windows Server 2012 R2 (KB5030184)
2023-09-12 07:00:00
September 12, 2023-KB5030179 Cumulative Update for .NET Framework 3.5, 4.8 and 4.8.1 for Windows 10 Version 21H2
2023-09-12 07:00:00
September 12, 2023-KB5030180 Cumulative Update for .NET Framework 3.5, 4.8 and 4.8.1 for Windows 10 Version 22H2
2023-09-12 07:00:00
github
github
Microsoft Security Advisory CVE-2023-36794: .NET Remote Code Execution Vulnerability
2023-09-12 20:26:05
Microsoft Security Advisory CVE-2023-36793: .NET Remote Code Execution Vulnerability
2023-09-12 20:15:59
Microsoft Security Advisory CVE-2023-36792: .NET Remote Code Execution Vulnerability
2023-09-12 20:51:36
osv
osv
Microsoft Security Advisory CVE-2023-36793: .NET Remote Code Execution Vulnerability
2023-09-12 20:15:59
Microsoft Security Advisory CVE-2023-36794: .NET Remote Code Execution Vulnerability
2023-09-12 20:26:05
Microsoft Security Advisory CVE-2023-36792: .NET Remote Code Execution Vulnerability
2023-09-12 20:51:36
talosblog
talosblog
Microsoft Patch Tuesday for September 2023 — Unusually low 5 critical vulnerabilities included in Microsoft Patch Tuesday, along with two zero-days
2023-09-12 20:51:07
prion
prion
Privilege escalation
2023-09-12 17:15:00
Remote code execution
2023-09-12 17:15:00
Remote code execution
2023-09-12 17:15:00
mscve
mscve
Azure DevOps Server Remote Code Execution Vulnerability
2023-09-12 07:00:00
Visual Studio Elevation of Privilege Vulnerability
2023-09-12 07:00:00
Visual Studio Elevation of Privilege Vulnerability
2023-09-12 07:00:00
kaspersky
kaspersky
KLA60565 Multiple vulnerabilities in Microsoft Azure
2023-09-12 00:00:00
cve
cve
CVE-2023-36742
2023-09-12 17:15:10
CVE-2023-36759
2023-09-12 17:15:11
CVE-2023-33136
2023-09-12 17:15:09
zdi
zdi
Microsoft Azure DevOps Server MachinePropertyBag Deserialization of Untrusted Data Local Privilege Escalation Vulnerability
2023-09-12 00:00:00
cnvd
cnvd
Microsoft Visual Studio Code Remote Code Execution Vulnerability (CNVD-2023-72223)
2023-09-15 00:00:00
freebsd
freebsd
vscode -- VS Code Remote Code Execution Vulnerability
2023-09-12 00:00:00
ubuntucve
ubuntucve
CVE-2023-36788
2023-09-12 00:00:00
CVE-2023-36794
2023-09-12 00:00:00
CVE-2023-36792
2023-09-12 00:00:00
redhatcve
redhatcve
CVE-2023-36788
2023-10-30 05:57:12
CVE-2023-36796
2023-09-13 09:55:32
CVE-2023-36792
2023-09-13 09:55:22
alpinelinux
alpinelinux
CVE-2023-36796
2023-09-12 17:15:15
CVE-2023-36794
2023-09-12 17:15:14
CVE-2023-36792
2023-09-12 17:15:14
veracode
veracode
Remote Code Execution
2023-09-15 07:07:32
Remote Code Execution (RCE)
2023-10-02 19:25:45
Remote Code Execution
2023-09-14 10:47:31
redhat
redhat
(RHSA-2023:5142) Moderate: .NET 6.0 security and bug fix update
2023-09-13 09:19:20
(RHSA-2023:6242) Moderate: .NET 6.0 security update
2023-11-01 13:55:23
(RHSA-2023:6247) Moderate: .NET 7.0 security update
2023-11-01 14:22:25
almalinux
almalinux
Moderate: .NET 7.0 security update
2023-09-13 00:00:00
Moderate: .NET 6.0 security update
2023-09-13 00:00:00
Moderate: .NET 7.0 security update
2023-11-01 00:00:00
oraclelinux
oraclelinux
.NET 6.0 security update
2023-09-14 00:00:00
.NET 7.0 security update
2023-09-14 00:00:00
.NET 7.0 security update
2023-11-02 00:00:00
rocky
rocky
.NET 6.0 security update
2023-09-19 12:09:00
.NET 6.0 security update
2023-11-11 23:00:10
ubuntu
ubuntu
.Net regressions
2023-10-25 00:00:00
.NET vulnerability
2023-09-12 00:00:00

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

8.7 High

AI Score

Confidence

High

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.017 Low

EPSS

Percentile

87.6%

JSON
Related for KLA60561
openvas10nessus40mskb23github6osv31talosblog1prion12mscve12kaspersky1cve12zdi1cnvd1freebsd1ubuntucve6redhatcve6alpinelinux4veracode5redhat7almalinux8oraclelinux8rocky2ubuntu2