gsd-2023-33170
Vulnerability from gsd
Modified
2023-12-13 01:20
Details
ASP.NET and Visual Studio Security Feature Bypass Vulnerability
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2023-33170",
"id": "GSD-2023-33170"
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2023-33170"
],
"details": "ASP.NET and Visual Studio Security Feature Bypass Vulnerability",
"id": "GSD-2023-33170",
"modified": "2023-12-13T01:20:37.707277Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "secure@microsoft.com",
"ID": "CVE-2023-33170",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Microsoft Visual Studio 2022 version 17.2",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "17.2.0",
"version_value": "17.2.17"
}
]
}
},
{
"product_name": "Microsoft Visual Studio 2022 version 17.0",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "17.0.0",
"version_value": "17.0.23"
}
]
}
},
{
"product_name": "Microsoft Visual Studio 2022 version 17.4",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "17.4.0",
"version_value": "17.4.9"
}
]
}
},
{
"product_name": "Microsoft Visual Studio 2022 version 17.6",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "17.6.0",
"version_value": "17.6.5"
}
]
}
},
{
"product_name": ".NET 6.0",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "6.0.0",
"version_value": "6.0.20"
}
]
}
},
{
"product_name": ".NET 7.0",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "7.0.0",
"version_value": "7.0.9"
}
]
}
}
]
},
"vendor_name": "Microsoft"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "ASP.NET and Visual Studio Security Feature Bypass Vulnerability"
}
]
},
"impact": {
"cvss": [
{
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Security Feature Bypass"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-33170",
"refsource": "MISC",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-33170"
},
{
"name": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EVZVMMCCBBCSCPAW2CRQGOTKIHVFCMRO/",
"refsource": "MISC",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EVZVMMCCBBCSCPAW2CRQGOTKIHVFCMRO/"
},
{
"name": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TLWNIIA2I6YCYVCXYBPBRSZ3UH6KILTG/",
"refsource": "MISC",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TLWNIIA2I6YCYVCXYBPBRSZ3UH6KILTG/"
},
{
"name": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Y3VJRGNYJXGPF5LXUG3NL45QPK2UU6PL/",
"refsource": "MISC",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Y3VJRGNYJXGPF5LXUG3NL45QPK2UU6PL/"
},
{
"name": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O5CFOR6ID2HP45E7ZOGQNX76FPIWP7XR/",
"refsource": "MISC",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O5CFOR6ID2HP45E7ZOGQNX76FPIWP7XR/"
}
]
}
},
"gitlab.com": {
"advisories": [
{
"affected_range": "(,2.2.4)",
"affected_versions": "All versions before 2.2.4",
"cvss_v3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe_ids": [
"CWE-1035",
"CWE-362",
"CWE-78",
"CWE-937"
],
"date": "2023-07-24",
"description": "ASP.NET and Visual Studio Security Feature Bypass Vulnerability",
"fixed_versions": [
"2.2.4"
],
"identifier": "CVE-2023-33170",
"identifiers": [
"GHSA-25c8-p796-jg6r",
"CVE-2023-33170"
],
"not_impacted": "All versions starting from 2.2.4",
"package_slug": "nuget/Microsoft.AspNet.Identity.Owin",
"pubdate": "2023-07-11",
"solution": "Upgrade to version 2.2.4 or above.",
"title": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"urls": [
"https://github.com/dotnet/aspnetcore/security/advisories/GHSA-25c8-p796-jg6r",
"https://nvd.nist.gov/vuln/detail/CVE-2023-33170",
"https://github.com/dotnet/aspnetcore/issues/49334",
"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-33170",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EVZVMMCCBBCSCPAW2CRQGOTKIHVFCMRO/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O5CFOR6ID2HP45E7ZOGQNX76FPIWP7XR/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TLWNIIA2I6YCYVCXYBPBRSZ3UH6KILTG/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Y3VJRGNYJXGPF5LXUG3NL45QPK2UU6PL/",
"https://github.com/advisories/GHSA-25c8-p796-jg6r"
],
"uuid": "d3b1ae43-d68d-4e11-b276-c0a8b5313172"
},
{
"affected_range": "(,6.0.20),[7.0.0,7.0.9)",
"affected_versions": "All versions before 6.0.20, all versions starting from 7.0.0 before 7.0.9",
"cvss_v3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe_ids": [
"CWE-1035",
"CWE-362",
"CWE-78",
"CWE-937"
],
"date": "2023-07-24",
"description": "ASP.NET and Visual Studio Security Feature Bypass Vulnerability",
"fixed_versions": [
"6.0.20",
"7.0.9"
],
"identifier": "CVE-2023-33170",
"identifiers": [
"GHSA-25c8-p796-jg6r",
"CVE-2023-33170"
],
"not_impacted": "All versions starting from 6.0.20 before 7.0.0, all versions starting from 7.0.9",
"package_slug": "nuget/Microsoft.AspNetCore.App.Runtime.linux-arm",
"pubdate": "2023-07-11",
"solution": "Upgrade to versions 6.0.20, 7.0.9 or above.",
"title": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"urls": [
"https://github.com/dotnet/aspnetcore/security/advisories/GHSA-25c8-p796-jg6r",
"https://nvd.nist.gov/vuln/detail/CVE-2023-33170",
"https://github.com/dotnet/aspnetcore/issues/49334",
"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-33170",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EVZVMMCCBBCSCPAW2CRQGOTKIHVFCMRO/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O5CFOR6ID2HP45E7ZOGQNX76FPIWP7XR/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TLWNIIA2I6YCYVCXYBPBRSZ3UH6KILTG/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Y3VJRGNYJXGPF5LXUG3NL45QPK2UU6PL/",
"https://github.com/advisories/GHSA-25c8-p796-jg6r"
],
"uuid": "1a786b44-5768-4d04-96e2-32ede17686cd"
},
{
"affected_range": "(,6.0.20),[7.0.0,7.0.9)",
"affected_versions": "All versions before 6.0.20, all versions starting from 7.0.0 before 7.0.9",
"cvss_v3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe_ids": [
"CWE-1035",
"CWE-362",
"CWE-78",
"CWE-937"
],
"date": "2023-07-24",
"description": "ASP.NET and Visual Studio Security Feature Bypass Vulnerability",
"fixed_versions": [
"6.0.20",
"7.0.9"
],
"identifier": "CVE-2023-33170",
"identifiers": [
"GHSA-25c8-p796-jg6r",
"CVE-2023-33170"
],
"not_impacted": "All versions starting from 6.0.20 before 7.0.0, all versions starting from 7.0.9",
"package_slug": "nuget/Microsoft.AspNetCore.App.Runtime.linux-arm64",
"pubdate": "2023-07-11",
"solution": "Upgrade to versions 6.0.20, 7.0.9 or above.",
"title": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"urls": [
"https://github.com/dotnet/aspnetcore/security/advisories/GHSA-25c8-p796-jg6r",
"https://nvd.nist.gov/vuln/detail/CVE-2023-33170",
"https://github.com/dotnet/aspnetcore/issues/49334",
"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-33170",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EVZVMMCCBBCSCPAW2CRQGOTKIHVFCMRO/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O5CFOR6ID2HP45E7ZOGQNX76FPIWP7XR/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TLWNIIA2I6YCYVCXYBPBRSZ3UH6KILTG/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Y3VJRGNYJXGPF5LXUG3NL45QPK2UU6PL/",
"https://github.com/advisories/GHSA-25c8-p796-jg6r"
],
"uuid": "fffe1abf-3d62-4a4b-a902-b9917b073bd6"
},
{
"affected_range": "(,6.0.20),[7.0.0,7.0.9)",
"affected_versions": "All versions before 6.0.20, all versions starting from 7.0.0 before 7.0.9",
"cvss_v3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe_ids": [
"CWE-1035",
"CWE-362",
"CWE-78",
"CWE-937"
],
"date": "2023-07-24",
"description": "ASP.NET and Visual Studio Security Feature Bypass Vulnerability",
"fixed_versions": [
"6.0.20",
"7.0.9"
],
"identifier": "CVE-2023-33170",
"identifiers": [
"GHSA-25c8-p796-jg6r",
"CVE-2023-33170"
],
"not_impacted": "All versions starting from 6.0.20 before 7.0.0, all versions starting from 7.0.9",
"package_slug": "nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-arm",
"pubdate": "2023-07-11",
"solution": "Upgrade to versions 6.0.20, 7.0.9 or above.",
"title": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"urls": [
"https://github.com/dotnet/aspnetcore/security/advisories/GHSA-25c8-p796-jg6r",
"https://nvd.nist.gov/vuln/detail/CVE-2023-33170",
"https://github.com/dotnet/aspnetcore/issues/49334",
"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-33170",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EVZVMMCCBBCSCPAW2CRQGOTKIHVFCMRO/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O5CFOR6ID2HP45E7ZOGQNX76FPIWP7XR/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TLWNIIA2I6YCYVCXYBPBRSZ3UH6KILTG/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Y3VJRGNYJXGPF5LXUG3NL45QPK2UU6PL/",
"https://github.com/advisories/GHSA-25c8-p796-jg6r"
],
"uuid": "d7d9a46f-3a05-4950-bb84-6272542ee0f9"
},
{
"affected_range": "(,6.0.20),[7.0.0,7.0.9)",
"affected_versions": "All versions before 6.0.20, all versions starting from 7.0.0 before 7.0.9",
"cvss_v3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe_ids": [
"CWE-1035",
"CWE-362",
"CWE-78",
"CWE-937"
],
"date": "2023-07-24",
"description": "ASP.NET and Visual Studio Security Feature Bypass Vulnerability",
"fixed_versions": [
"6.0.20",
"7.0.9"
],
"identifier": "CVE-2023-33170",
"identifiers": [
"GHSA-25c8-p796-jg6r",
"CVE-2023-33170"
],
"not_impacted": "All versions starting from 6.0.20 before 7.0.0, all versions starting from 7.0.9",
"package_slug": "nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64",
"pubdate": "2023-07-11",
"solution": "Upgrade to versions 6.0.20, 7.0.9 or above.",
"title": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"urls": [
"https://github.com/dotnet/aspnetcore/security/advisories/GHSA-25c8-p796-jg6r",
"https://nvd.nist.gov/vuln/detail/CVE-2023-33170",
"https://github.com/dotnet/aspnetcore/issues/49334",
"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-33170",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EVZVMMCCBBCSCPAW2CRQGOTKIHVFCMRO/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O5CFOR6ID2HP45E7ZOGQNX76FPIWP7XR/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TLWNIIA2I6YCYVCXYBPBRSZ3UH6KILTG/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Y3VJRGNYJXGPF5LXUG3NL45QPK2UU6PL/",
"https://github.com/advisories/GHSA-25c8-p796-jg6r"
],
"uuid": "f4b88d06-c921-4307-aefe-a62cd85b8b89"
},
{
"affected_range": "(,6.0.20),[7.0.0,7.0.9)",
"affected_versions": "All versions before 6.0.20, all versions starting from 7.0.0 before 7.0.9",
"cvss_v3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe_ids": [
"CWE-1035",
"CWE-362",
"CWE-78",
"CWE-937"
],
"date": "2023-07-24",
"description": "ASP.NET and Visual Studio Security Feature Bypass Vulnerability",
"fixed_versions": [
"6.0.20",
"7.0.9"
],
"identifier": "CVE-2023-33170",
"identifiers": [
"GHSA-25c8-p796-jg6r",
"CVE-2023-33170"
],
"not_impacted": "All versions starting from 6.0.20 before 7.0.0, all versions starting from 7.0.9",
"package_slug": "nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-x64",
"pubdate": "2023-07-11",
"solution": "Upgrade to versions 6.0.20, 7.0.9 or above.",
"title": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"urls": [
"https://github.com/dotnet/aspnetcore/security/advisories/GHSA-25c8-p796-jg6r",
"https://nvd.nist.gov/vuln/detail/CVE-2023-33170",
"https://github.com/dotnet/aspnetcore/issues/49334",
"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-33170",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EVZVMMCCBBCSCPAW2CRQGOTKIHVFCMRO/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O5CFOR6ID2HP45E7ZOGQNX76FPIWP7XR/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TLWNIIA2I6YCYVCXYBPBRSZ3UH6KILTG/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Y3VJRGNYJXGPF5LXUG3NL45QPK2UU6PL/",
"https://github.com/advisories/GHSA-25c8-p796-jg6r"
],
"uuid": "c324f0ef-be47-49a7-a83a-047b632bcfd5"
},
{
"affected_range": "(,6.0.20),[7.0.0,7.0.9)",
"affected_versions": "All versions before 6.0.20, all versions starting from 7.0.0 before 7.0.9",
"cvss_v3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe_ids": [
"CWE-1035",
"CWE-362",
"CWE-78",
"CWE-937"
],
"date": "2023-07-24",
"description": "ASP.NET and Visual Studio Security Feature Bypass Vulnerability",
"fixed_versions": [
"6.0.20",
"7.0.9"
],
"identifier": "CVE-2023-33170",
"identifiers": [
"GHSA-25c8-p796-jg6r",
"CVE-2023-33170"
],
"not_impacted": "All versions starting from 6.0.20 before 7.0.0, all versions starting from 7.0.9",
"package_slug": "nuget/Microsoft.AspNetCore.App.Runtime.linux-x64",
"pubdate": "2023-07-11",
"solution": "Upgrade to versions 6.0.20, 7.0.9 or above.",
"title": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"urls": [
"https://github.com/dotnet/aspnetcore/security/advisories/GHSA-25c8-p796-jg6r",
"https://nvd.nist.gov/vuln/detail/CVE-2023-33170",
"https://github.com/dotnet/aspnetcore/issues/49334",
"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-33170",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EVZVMMCCBBCSCPAW2CRQGOTKIHVFCMRO/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O5CFOR6ID2HP45E7ZOGQNX76FPIWP7XR/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TLWNIIA2I6YCYVCXYBPBRSZ3UH6KILTG/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Y3VJRGNYJXGPF5LXUG3NL45QPK2UU6PL/",
"https://github.com/advisories/GHSA-25c8-p796-jg6r"
],
"uuid": "9f665904-2ce7-442a-97a9-529a76a58f20"
},
{
"affected_range": "(,6.0.20),[7.0.0,7.0.9)",
"affected_versions": "All versions before 6.0.20, all versions starting from 7.0.0 before 7.0.9",
"cvss_v3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe_ids": [
"CWE-1035",
"CWE-362",
"CWE-78",
"CWE-937"
],
"date": "2023-07-24",
"description": "ASP.NET and Visual Studio Security Feature Bypass Vulnerability",
"fixed_versions": [
"6.0.20",
"7.0.9"
],
"identifier": "CVE-2023-33170",
"identifiers": [
"GHSA-25c8-p796-jg6r",
"CVE-2023-33170"
],
"not_impacted": "All versions starting from 6.0.20 before 7.0.0, all versions starting from 7.0.9",
"package_slug": "nuget/Microsoft.AspNetCore.App.Runtime.osx-arm64",
"pubdate": "2023-07-11",
"solution": "Upgrade to versions 6.0.20, 7.0.9 or above.",
"title": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"urls": [
"https://github.com/dotnet/aspnetcore/security/advisories/GHSA-25c8-p796-jg6r",
"https://nvd.nist.gov/vuln/detail/CVE-2023-33170",
"https://github.com/dotnet/aspnetcore/issues/49334",
"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-33170",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EVZVMMCCBBCSCPAW2CRQGOTKIHVFCMRO/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O5CFOR6ID2HP45E7ZOGQNX76FPIWP7XR/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TLWNIIA2I6YCYVCXYBPBRSZ3UH6KILTG/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Y3VJRGNYJXGPF5LXUG3NL45QPK2UU6PL/",
"https://github.com/advisories/GHSA-25c8-p796-jg6r"
],
"uuid": "6f061b17-94c5-4a3d-91f0-45b1914a9f14"
},
{
"affected_range": "(,6.0.20),[7.0.0,7.0.9)",
"affected_versions": "All versions before 6.0.20, all versions starting from 7.0.0 before 7.0.9",
"cvss_v3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe_ids": [
"CWE-1035",
"CWE-362",
"CWE-78",
"CWE-937"
],
"date": "2023-07-24",
"description": "ASP.NET and Visual Studio Security Feature Bypass Vulnerability",
"fixed_versions": [
"6.0.20",
"7.0.9"
],
"identifier": "CVE-2023-33170",
"identifiers": [
"GHSA-25c8-p796-jg6r",
"CVE-2023-33170"
],
"not_impacted": "All versions starting from 6.0.20 before 7.0.0, all versions starting from 7.0.9",
"package_slug": "nuget/Microsoft.AspNetCore.App.Runtime.osx-x64",
"pubdate": "2023-07-11",
"solution": "Upgrade to versions 6.0.20, 7.0.9 or above.",
"title": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"urls": [
"https://github.com/dotnet/aspnetcore/security/advisories/GHSA-25c8-p796-jg6r",
"https://nvd.nist.gov/vuln/detail/CVE-2023-33170",
"https://github.com/dotnet/aspnetcore/issues/49334",
"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-33170",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EVZVMMCCBBCSCPAW2CRQGOTKIHVFCMRO/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O5CFOR6ID2HP45E7ZOGQNX76FPIWP7XR/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TLWNIIA2I6YCYVCXYBPBRSZ3UH6KILTG/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Y3VJRGNYJXGPF5LXUG3NL45QPK2UU6PL/",
"https://github.com/advisories/GHSA-25c8-p796-jg6r"
],
"uuid": "4283b5f5-5900-483a-8b3c-393714b4bd0a"
},
{
"affected_range": "(,6.0.20),[7.0.0,7.0.9)",
"affected_versions": "All versions before 6.0.20, all versions starting from 7.0.0 before 7.0.9",
"cvss_v3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe_ids": [
"CWE-1035",
"CWE-362",
"CWE-78",
"CWE-937"
],
"date": "2023-07-24",
"description": "ASP.NET and Visual Studio Security Feature Bypass Vulnerability",
"fixed_versions": [
"6.0.20",
"7.0.9"
],
"identifier": "CVE-2023-33170",
"identifiers": [
"GHSA-25c8-p796-jg6r",
"CVE-2023-33170"
],
"not_impacted": "All versions starting from 6.0.20 before 7.0.0, all versions starting from 7.0.9",
"package_slug": "nuget/Microsoft.AspNetCore.App.Runtime.win-arm",
"pubdate": "2023-07-11",
"solution": "Upgrade to versions 6.0.20, 7.0.9 or above.",
"title": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"urls": [
"https://github.com/dotnet/aspnetcore/security/advisories/GHSA-25c8-p796-jg6r",
"https://nvd.nist.gov/vuln/detail/CVE-2023-33170",
"https://github.com/dotnet/aspnetcore/issues/49334",
"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-33170",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EVZVMMCCBBCSCPAW2CRQGOTKIHVFCMRO/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O5CFOR6ID2HP45E7ZOGQNX76FPIWP7XR/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TLWNIIA2I6YCYVCXYBPBRSZ3UH6KILTG/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Y3VJRGNYJXGPF5LXUG3NL45QPK2UU6PL/",
"https://github.com/advisories/GHSA-25c8-p796-jg6r"
],
"uuid": "74631252-788f-4aa0-a88e-178e91c5f6b9"
},
{
"affected_range": "(,6.0.20),[7.0.0,7.0.9)",
"affected_versions": "All versions before 6.0.20, all versions starting from 7.0.0 before 7.0.9",
"cvss_v3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe_ids": [
"CWE-1035",
"CWE-362",
"CWE-78",
"CWE-937"
],
"date": "2023-07-24",
"description": "ASP.NET and Visual Studio Security Feature Bypass Vulnerability",
"fixed_versions": [
"6.0.20",
"7.0.9"
],
"identifier": "CVE-2023-33170",
"identifiers": [
"GHSA-25c8-p796-jg6r",
"CVE-2023-33170"
],
"not_impacted": "All versions starting from 6.0.20 before 7.0.0, all versions starting from 7.0.9",
"package_slug": "nuget/Microsoft.AspNetCore.App.Runtime.win-arm64",
"pubdate": "2023-07-11",
"solution": "Upgrade to versions 6.0.20, 7.0.9 or above.",
"title": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"urls": [
"https://github.com/dotnet/aspnetcore/security/advisories/GHSA-25c8-p796-jg6r",
"https://nvd.nist.gov/vuln/detail/CVE-2023-33170",
"https://github.com/dotnet/aspnetcore/issues/49334",
"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-33170",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EVZVMMCCBBCSCPAW2CRQGOTKIHVFCMRO/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O5CFOR6ID2HP45E7ZOGQNX76FPIWP7XR/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TLWNIIA2I6YCYVCXYBPBRSZ3UH6KILTG/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Y3VJRGNYJXGPF5LXUG3NL45QPK2UU6PL/",
"https://github.com/advisories/GHSA-25c8-p796-jg6r"
],
"uuid": "0d841f8b-c20f-4ee1-8601-26a51fa0b323"
},
{
"affected_range": "(,6.0.20),[7.0.0,7.0.9)",
"affected_versions": "All versions before 6.0.20, all versions starting from 7.0.0 before 7.0.9",
"cvss_v3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe_ids": [
"CWE-1035",
"CWE-362",
"CWE-78",
"CWE-937"
],
"date": "2023-07-24",
"description": "ASP.NET and Visual Studio Security Feature Bypass Vulnerability",
"fixed_versions": [
"6.0.20",
"7.0.9"
],
"identifier": "CVE-2023-33170",
"identifiers": [
"GHSA-25c8-p796-jg6r",
"CVE-2023-33170"
],
"not_impacted": "All versions starting from 6.0.20 before 7.0.0, all versions starting from 7.0.9",
"package_slug": "nuget/Microsoft.AspNetCore.App.Runtime.win-x64",
"pubdate": "2023-07-11",
"solution": "Upgrade to versions 6.0.20, 7.0.9 or above.",
"title": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"urls": [
"https://github.com/dotnet/aspnetcore/security/advisories/GHSA-25c8-p796-jg6r",
"https://nvd.nist.gov/vuln/detail/CVE-2023-33170",
"https://github.com/dotnet/aspnetcore/issues/49334",
"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-33170",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EVZVMMCCBBCSCPAW2CRQGOTKIHVFCMRO/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O5CFOR6ID2HP45E7ZOGQNX76FPIWP7XR/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TLWNIIA2I6YCYVCXYBPBRSZ3UH6KILTG/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Y3VJRGNYJXGPF5LXUG3NL45QPK2UU6PL/",
"https://github.com/advisories/GHSA-25c8-p796-jg6r"
],
"uuid": "5871a852-0aab-44a4-aea5-2ae431f1b2dd"
},
{
"affected_range": "(,6.0.20),[7.0.0,7.0.9)",
"affected_versions": "All versions before 6.0.20, all versions starting from 7.0.0 before 7.0.9",
"cvss_v3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe_ids": [
"CWE-1035",
"CWE-362",
"CWE-78",
"CWE-937"
],
"date": "2023-07-24",
"description": "ASP.NET and Visual Studio Security Feature Bypass Vulnerability",
"fixed_versions": [
"6.0.20",
"7.0.9"
],
"identifier": "CVE-2023-33170",
"identifiers": [
"GHSA-25c8-p796-jg6r",
"CVE-2023-33170"
],
"not_impacted": "All versions starting from 6.0.20 before 7.0.0, all versions starting from 7.0.9",
"package_slug": "nuget/Microsoft.AspNetCore.App.Runtime.win-x86",
"pubdate": "2023-07-11",
"solution": "Upgrade to versions 6.0.20, 7.0.9 or above.",
"title": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"urls": [
"https://github.com/dotnet/aspnetcore/security/advisories/GHSA-25c8-p796-jg6r",
"https://nvd.nist.gov/vuln/detail/CVE-2023-33170",
"https://github.com/dotnet/aspnetcore/issues/49334",
"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-33170",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EVZVMMCCBBCSCPAW2CRQGOTKIHVFCMRO/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O5CFOR6ID2HP45E7ZOGQNX76FPIWP7XR/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TLWNIIA2I6YCYVCXYBPBRSZ3UH6KILTG/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Y3VJRGNYJXGPF5LXUG3NL45QPK2UU6PL/",
"https://github.com/advisories/GHSA-25c8-p796-jg6r"
],
"uuid": "361dfb82-97f8-42f5-8630-328e9feae58d"
},
{
"affected_range": "(,2.1.39)",
"affected_versions": "All versions before 2.1.39",
"cvss_v3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe_ids": [
"CWE-1035",
"CWE-362",
"CWE-78",
"CWE-937"
],
"date": "2023-07-24",
"description": "ASP.NET and Visual Studio Security Feature Bypass Vulnerability",
"fixed_versions": [
"2.1.39"
],
"identifier": "CVE-2023-33170",
"identifiers": [
"GHSA-25c8-p796-jg6r",
"CVE-2023-33170"
],
"not_impacted": "All versions starting from 2.1.39",
"package_slug": "nuget/Microsoft.AspNetCore.Identity",
"pubdate": "2023-07-11",
"solution": "Upgrade to version 2.1.39 or above.",
"title": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"urls": [
"https://github.com/dotnet/aspnetcore/security/advisories/GHSA-25c8-p796-jg6r",
"https://nvd.nist.gov/vuln/detail/CVE-2023-33170",
"https://github.com/dotnet/aspnetcore/issues/49334",
"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-33170",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EVZVMMCCBBCSCPAW2CRQGOTKIHVFCMRO/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O5CFOR6ID2HP45E7ZOGQNX76FPIWP7XR/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TLWNIIA2I6YCYVCXYBPBRSZ3UH6KILTG/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Y3VJRGNYJXGPF5LXUG3NL45QPK2UU6PL/",
"https://github.com/advisories/GHSA-25c8-p796-jg6r"
],
"uuid": "95f9a709-002c-450c-a113-b2530febd1a4"
}
]
},
"nvd.nist.gov": {
"cve": {
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*",
"matchCriteriaId": "5730CE86-D1BB-403D-BE28-09BAC686B645",
"versionEndExcluding": "6.0.20",
"versionStartIncluding": "6.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*",
"matchCriteriaId": "4EBEC922-21D4-458E-B9A9-A29CAD09C2D3",
"versionEndExcluding": "7.0.9",
"versionStartIncluding": "7.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*",
"matchCriteriaId": "46E1B01E-2B9A-4666-A680-DED9669FD62B",
"versionEndExcluding": "17.0.23",
"versionStartIncluding": "17.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*",
"matchCriteriaId": "63B52F8F-CF6B-40C5-B4D9-342FA4C3D21C",
"versionEndExcluding": "17.2.17",
"versionStartIncluding": "17.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*",
"matchCriteriaId": "45D57A7D-14A4-4916-B029-12E8D3C8EDAD",
"versionEndExcluding": "17.4.9",
"versionStartIncluding": "17.4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D8771AEC-CE62-4C47-922A-A6205FDF3ECE",
"versionEndExcluding": "17.6.5",
"versionStartIncluding": "17.6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*",
"matchCriteriaId": "E30D0E6F-4AE8-4284-8716-991DFA48CC5D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*",
"matchCriteriaId": "CC559B26-5DFC-4B7A-A27C-B77DE755DFF9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ASP.NET and Visual Studio Security Feature Bypass Vulnerability"
}
],
"id": "CVE-2023-33170",
"lastModified": "2023-12-13T16:14:12.353",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.2,
"impactScore": 5.9,
"source": "secure@microsoft.com",
"type": "Primary"
}
]
},
"published": "2023-07-11T18:15:15.660",
"references": [
{
"source": "secure@microsoft.com",
"tags": [
"Mailing List"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EVZVMMCCBBCSCPAW2CRQGOTKIHVFCMRO/"
},
{
"source": "secure@microsoft.com",
"tags": [
"Mailing List"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O5CFOR6ID2HP45E7ZOGQNX76FPIWP7XR/"
},
{
"source": "secure@microsoft.com",
"tags": [
"Mailing List"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TLWNIIA2I6YCYVCXYBPBRSZ3UH6KILTG/"
},
{
"source": "secure@microsoft.com",
"tags": [
"Mailing List"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Y3VJRGNYJXGPF5LXUG3NL45QPK2UU6PL/"
},
{
"source": "secure@microsoft.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-33170"
}
],
"sourceIdentifier": "secure@microsoft.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-362"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
}
}
}
Loading...