CVE-2023-38180highunder attackCWE-400

CVE-2023-38180: high-severity vulnerability in Microsoft ASP.NET Core 2.1

.NET and Visual Studio Denial of Service Vulnerability

Published · Updated

Follow this CVE+ Monitor Microsoft Visual Studio+ Monitor .NET

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

56Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Actcvss 7.5epss 14%
from disclosure to weapon
Published on NVDAug 8
CISA KEV+1d
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Fixed
11 products (752 components)
Red Hat Enterprise Linux AppStream (v. 8) · Red Hat Enterprise Linux CRB (v. 8) · Red Hat Enterprise Linux AppStream (v. 9) · Red Hat Enterprise Linux CRB (v. 9) · Red Hat CodeReady Linux Builder EUS (v.8.6) · and others 6
fix ↗
Action required by CISAfederal deadline: 2023-08-30

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

In short

A denial of service vulnerability in .NET and Visual Studio allows an attacker to crash or freeze the application by sending specially crafted input. This can disrupt services and prevent legitimate users from accessing the application.

Technical detail

CWE-400 (Uncontrolled Resource Consumption) vulnerability affecting .NET and Visual Studio where malicious input triggers excessive resource consumption, leading to denial of service. The attack requires the attacker to send crafted data to the affected application, causing it to exhaust CPU, memory, or other critical resources and become unresponsive.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

.NET and Visual Studio Denial of Service Vulnerability
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C
Affected products
Microsoft · ASP.NET Core 2.1Microsoft · Microsoft Visual Studio 2022 version 17.2Microsoft · Microsoft Visual Studio 2022 version 17.4Microsoft · Microsoft Visual Studio 2022 version 17.6Microsoft · .NET 6.0Microsoft · .NET 7.0
Related CVEs — Microsoft ASP.NET Core 2.1

In the same product, most dangerous first.

CVE-2023-38171HIGHMicrosoft QUIC Denial of Service VulnerabilityEPSS 71.0%CVE-2023-36049HIGH.NET, .NET Framework, and Visual Studio Elevation of Privilege VulnerabilityEPSS 6.8%CVE-2020-1597—ASP.NET Core Denial of Service VulnerabilityEPSS 6.6%CVE-2022-30184MEDIUM.NET and Visual Studio Information Disclosure VulnerabilityEPSS 6.1%CVE-2020-1045HIGHMicrosoft ASP.NET Core Security Feature Bypass VulnerabilityEPSS 5.9%CVE-2023-36799MEDIUM.NET Core and Visual Studio Denial of Service VulnerabilityEPSS 4.6%