CVE-2023-36899 : ASP.NET Elevation of Privilege Vulnerability

ASP.NET Elevation of Privilege Vulnerability

Published 2023-08-08 19:15:10

Updated 2024-05-29 02:16:25

Source Microsoft Corporation

View at NVD, CVE.org

Vulnerability category: Gain privilege

Products affected by CVE-2023-36899

Microsoft » .net Framework » Version: 2.0 Update SP2
cpe:2.3:a:microsoft:.net_framework:2.0:sp2:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows Server 2008 » Version: N/A Update SP2 For X64
When used together with: Microsoft » Windows Server 2008 » Version: N/A Update SP2 For X86
Microsoft » .net Framework » Version: 3.5
cpe:2.3:a:microsoft:.net_framework:3.5:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows 10 1809 » Version: N/A For Arm64
When used together with: Microsoft » Windows 10 1809 » Version: N/A For X64
When used together with: Microsoft » Windows 10 1809 » Version: N/A For X86
When used together with: Microsoft » Windows 10 21h2 » Version: N/A For Arm64
When used together with: Microsoft » Windows 10 21h2 » Version: N/A For X64
When used together with: Microsoft » Windows 10 21h2 » Version: N/A For X86
When used together with: Microsoft » Windows 10 22h2 » Version: N/A For Arm64
When used together with: Microsoft » Windows 10 22h2 » Version: N/A For X64
When used together with: Microsoft » Windows 10 22h2 » Version: N/A For X86
When used together with: Microsoft » Windows 11 21h2 » Version: N/A For Arm64
When used together with: Microsoft » Windows 11 21h2 » Version: N/A For X64
When used together with: Microsoft » Windows Server 2016 » Version: N/A
When used together with: Microsoft » Windows Server 2019 » Version: N/A
When used together with: Microsoft » Windows Server 2022 » Version: N/A
Microsoft » .net Framework » Version: 4.6.2
cpe:2.3:a:microsoft:.net_framework:4.6.2:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows Server 2008 » Version: N/A Update SP2 For X64
When used together with: Microsoft » Windows Server 2008 » Version: R2 Update SP1 For X64
When used together with: Microsoft » Windows Server 2012 » Version: N/A
When used together with: Microsoft » Windows Server 2012 » Version: R2
When used together with: Microsoft » Windows Server 2016 » Version: N/A
Microsoft » .net Framework » Version: 4.7
cpe:2.3:a:microsoft:.net_framework:4.7:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows Server 2008 » Version: N/A Update SP2 For X64
When used together with: Microsoft » Windows Server 2008 » Version: R2 Update SP1 For X64
When used together with: Microsoft » Windows Server 2012 » Version: N/A
When used together with: Microsoft » Windows Server 2012 » Version: R2
When used together with: Microsoft » Windows Server 2016 » Version: N/A
Microsoft » .net Framework » Version: 4.7.1
cpe:2.3:a:microsoft:.net_framework:4.7.1:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows Server 2008 » Version: N/A Update SP2 For X64
When used together with: Microsoft » Windows Server 2008 » Version: R2 Update SP1 For X64
When used together with: Microsoft » Windows Server 2012 » Version: N/A
When used together with: Microsoft » Windows Server 2012 » Version: R2
When used together with: Microsoft » Windows Server 2016 » Version: N/A
Microsoft » .net Framework » Version: 4.7.2
cpe:2.3:a:microsoft:.net_framework:4.7.2:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows Server 2008 » Version: N/A Update SP2 For X64
When used together with: Microsoft » Windows Server 2008 » Version: R2 Update SP1 For X64
When used together with: Microsoft » Windows Server 2012 » Version: N/A
When used together with: Microsoft » Windows Server 2012 » Version: R2
When used together with: Microsoft » Windows Server 2016 » Version: N/A
Microsoft » .net Framework » Version: 4.8
cpe:2.3:a:microsoft:.net_framework:4.8:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows Server 2008 » Version: R2 Update SP1 For X64
When used together with: Microsoft » Windows Server 2012 » Version: N/A
When used together with: Microsoft » Windows Server 2012 » Version: R2
When used together with: Microsoft » Windows Server 2016 » Version: N/A
Microsoft » .net Framework » Version: 4.8.1
cpe:2.3:a:microsoft:.net_framework:4.8.1:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows 10 1809 » Version: N/A For Arm64
When used together with: Microsoft » Windows 10 1809 » Version: N/A For X64
When used together with: Microsoft » Windows 10 1809 » Version: N/A For X86
When used together with: Microsoft » Windows 10 21h2 » Version: N/A For Arm64
When used together with: Microsoft » Windows 10 21h2 » Version: N/A For X64
When used together with: Microsoft » Windows 10 21h2 » Version: N/A For X86
When used together with: Microsoft » Windows 10 22h2 » Version: N/A For Arm64
When used together with: Microsoft » Windows 10 22h2 » Version: N/A For X64
When used together with: Microsoft » Windows 10 22h2 » Version: N/A For X86
When used together with: Microsoft » Windows 11 21h2 » Version: N/A For Arm64
When used together with: Microsoft » Windows 11 21h2 » Version: N/A For X64
When used together with: Microsoft » Windows Server 2016 » Version: N/A
When used together with: Microsoft » Windows Server 2019 » Version: N/A
When used together with: Microsoft » Windows Server 2022 » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2023-36899

EPSS FAQ

0.09%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 40 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-36899

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
8.8	HIGH	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	2.8	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High
7.5	HIGH	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H	1.6	5.9	Microsoft Corporation
Attack Vector: Network Attack Complexity: High Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High
8.8	HIGH	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	2.8	5.9	Microsoft Corporation
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2023-36899

CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Assigned by: secure@microsoft.com (Secondary)

References for CVE-2023-36899

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36899

CVE-2023-36899 - Security Update Guide - Microsoft - ASP.NET Elevation of Privilege Vulnerability
Patch;Vendor Advisory

Jump to

Vulnerability Details : CVE-2023-36899

Products affected by CVE-2023-36899

Exploit prediction scoring system (EPSS) score for CVE-2023-36899

CVSS scores for CVE-2023-36899

CWE ids for CVE-2023-36899

References for CVE-2023-36899