CVE-2023-32032 - OpenCVE

.NET and Visual Studio Elevation of Privilege Vulnerability

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Microsoft	.net Powershell Visual Studio Visual Studio 2022
Redhat	Enterprise Linux

Configuration 1 [-]

OR	cpe:2.3:a:microsoft:.net::::::::
	cpe:2.3:a:microsoft:visual_studio_2022::::::::
	cpe:2.3:a:microsoft:visual_studio_2022::::::::
	cpe:2.3:a:microsoft:visual_studio_2022::::::::
	cpe:2.3:a:microsoft:visual_studio_2022::::::::

Package	CPE	Advisory	Released Date
Red Hat Enterprise Linux 8
dotnet7.0-0:7.0.107-1.el8_8	cpe:/a:redhat:enterprise_linux:8	RHSA-2023:3593	2023-06-14T00:00:00Z
Red Hat Enterprise Linux 9
dotnet7.0-0:7.0.107-1.el9_2	cpe:/a:redhat:enterprise_linux:9	RHSA-2023:3592	2023-06-14T00:00:00Z

References

Link	Providers
https://github.com/dotnet/core/blob/c73158b8ef08db362585f9ed16b97c1d1372c666/release-notes/6.0/6.0.18/6.0.18.md
https://github.com/dotnet/core/blob/c73158b8ef08db362585f9ed16b97c1d1372c666/release-notes/7.0/7.0.7/7.0.7.md
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-32032
https://nvd.nist.gov/vuln/detail/CVE-2023-32032
https://www.cve.org/CVERecord?id=CVE-2023-32032

History

No history.

MITRE

Status: PUBLISHED

Assigner: microsoft

Published: 2023-06-13T23:26:21.832Z

Updated: 2024-08-02T15:03:28.638Z

Reserved: 2023-05-01T15:34:52.133Z

Link: CVE-2023-32032

Vulnrichment

Updated: 2024-08-02T15:03:28.638Z

NVD

Status : Modified

Published: 2023-06-14T00:15:11.790

Modified: 2024-05-29T02:15:47.723

Link: CVE-2023-32032

Redhat

Severity : Important

Publid Date: 2023-06-14T00:00:00Z

Links: CVE-2023-32032 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-32032", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "state": "PUBLISHED", "assignerShortName": "microsoft", "dateReserved": "2023-05-01T15:34:52.133Z", "datePublished": "2023-06-13T23:26:21.832Z", "dateUpdated": "2024-08-02T15:03:28.638Z"}, "containers": {"cna": {"title": ".NET and Visual Studio Elevation of Privilege Vulnerability", "datePublic": "2023-06-13T07:00:00+00:00", "affected": [{"vendor": "Microsoft", "product": ".NET 7.0", "cpes": ["cpe:2.3:a:microsoft:.net:7.0.0:*:*:*:*:*:*:*"], "platforms": ["Unknown"], "versions": [{"version": "7.0.0", "lessThan": "7.0.7", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Visual Studio 2022 version 17.2", "cpes": ["cpe:2.3:a:microsoft:visual_studio_2022:17.2:*:*:*:*:*:*:*"], "platforms": ["Unknown"], "versions": [{"version": "17.2.0", "lessThan": "17.2.16", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Visual Studio 2022 version 17.0", "cpes": ["cpe:2.3:a:microsoft:visual_studio_2022:17.0:*:*:*:*:*:*:*"], "platforms": ["Unknown"], "versions": [{"version": "17.0.0", "lessThan": "17.0.22", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Visual Studio 2022 version 17.4", "cpes": ["cpe:2.3:a:microsoft:visual_studio_2022:17.4:*:*:*:*:*:*:*"], "platforms": ["Unknown"], "versions": [{"version": "17.4.0", "lessThan": "17.4.8", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Visual Studio 2022 version 17.6", "cpes": ["cpe:2.3:a:microsoft:visual_studio:2022:*:*:*:*:*:*:*"], "platforms": ["Unknown"], "versions": [{"version": "17.6.0", "lessThan": "17.6.3", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "PowerShell 7.3", "cpes": ["cpe:2.3:a:microsoft:powershell:7.3:-:*:*:*:*:*:*"], "platforms": ["Unknown"], "versions": [{"version": "7.3.0", "lessThan": "7.3.5", "versionType": "custom", "status": "affected"}]}], "descriptions": [{"value": ".NET and Visual Studio Elevation of Privilege Vulnerability", "lang": "en-US"}], "problemTypes": [{"descriptions": [{"description": "CWE-20: Improper Input Validation", "lang": "en-US", "type": "CWE", "cweId": "CWE-20"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2024-07-19T20:22:21.416Z"}, "references": [{"name": ".NET and Visual Studio Elevation of Privilege Vulnerability", "tags": ["vendor-advisory"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-32032"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "baseSeverity": "MEDIUM", "baseScore": 6.5, "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H/E:P/RL:O/RC:C"}}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-07-22T20:01:37.888322Z", "id": "CVE-2023-32032", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-22T20:01:48.177Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T15:03:28.638Z"}, "title": "CVE Program Container", "references": [{"name": ".NET and Visual Studio Elevation of Privilege Vulnerability", "tags": ["vendor-advisory", "x_transferred"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-32032"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-32032", "name": ".NET and Visual Studio Elevation of Privilege Vulnerability", "tags": ["vendor-advisory", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T15:03:28.638Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-32032", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-07-22T20:01:37.888322Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-19T18:29:14.836Z"}}], "cna": {"title": ".NET and Visual Studio Elevation of Privilege Vulnerability", "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H/E:P/RL:O/RC:C"}, "scenarios": [{"lang": "en-US", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:microsoft:.net:7.0.0:*:*:*:*:*:*:*"], "vendor": "Microsoft", "product": ".NET 7.0", "versions": [{"status": "affected", "version": "7.0.0", "lessThan": "7.0.7", "versionType": "custom"}], "platforms": ["Unknown"]}, {"cpes": ["cpe:2.3:a:microsoft:visual_studio_2022:17.2:*:*:*:*:*:*:*"], "vendor": "Microsoft", "product": "Microsoft Visual Studio 2022 version 17.2", "versions": [{"status": "affected", "version": "17.2.0", "lessThan": "17.2.16", "versionType": "custom"}], "platforms": ["Unknown"]}, {"cpes": ["cpe:2.3:a:microsoft:visual_studio_2022:17.0:*:*:*:*:*:*:*"], "vendor": "Microsoft", "product": "Microsoft Visual Studio 2022 version 17.0", "versions": [{"status": "affected", "version": "17.0.0", "lessThan": "17.0.22", "versionType": "custom"}], "platforms": ["Unknown"]}, {"cpes": ["cpe:2.3:a:microsoft:visual_studio_2022:17.4:*:*:*:*:*:*:*"], "vendor": "Microsoft", "product": "Microsoft Visual Studio 2022 version 17.4", "versions": [{"status": "affected", "version": "17.4.0", "lessThan": "17.4.8", "versionType": "custom"}], "platforms": ["Unknown"]}, {"cpes": ["cpe:2.3:a:microsoft:visual_studio:2022:*:*:*:*:*:*:*"], "vendor": "Microsoft", "product": "Microsoft Visual Studio 2022 version 17.6", "versions": [{"status": "affected", "version": "17.6.0", "lessThan": "17.6.3", "versionType": "custom"}], "platforms": ["Unknown"]}, {"cpes": ["cpe:2.3:a:microsoft:powershell:7.3:-:*:*:*:*:*:*"], "vendor": "Microsoft", "product": "PowerShell 7.3", "versions": [{"status": "affected", "version": "7.3.0", "lessThan": "7.3.5", "versionType": "custom"}], "platforms": ["Unknown"]}], "datePublic": "2023-06-13T07:00:00+00:00", "references": [{"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-32032", "name": ".NET and Visual Studio Elevation of Privilege Vulnerability", "tags": ["vendor-advisory"]}], "descriptions": [{"lang": "en-US", "value": ".NET and Visual Studio Elevation of Privilege Vulnerability"}], "problemTypes": [{"descriptions": [{"lang": "en-US", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20: Improper Input Validation"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2024-07-19T20:22:21.416Z"}}}, "cveMetadata": {"cveId": "CVE-2023-32032", "state": "PUBLISHED", "dateUpdated": "2024-08-02T15:03:28.638Z", "dateReserved": "2023-05-01T15:34:52.133Z", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "datePublished": "2023-06-13T23:26:21.832Z", "assignerShortName": "microsoft"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*", "matchCriteriaId": "5FABF6D4-EA23-4234-90D3-0D9306A2994B", "versionEndExcluding": "7.0.7", "versionStartIncluding": "7.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*", "matchCriteriaId": "2B1F98BC-0D82-4AEB-9E1E-D67325E99385", "versionEndExcluding": "17.0.22", "versionStartIncluding": "17.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*", "matchCriteriaId": "B6B0B496-BC41-4F9D-9A28-AE7664B5C77D", "versionEndExcluding": "17.2.16", "versionStartIncluding": "17.2", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*", "matchCriteriaId": "BC861E65-1682-4E99-8A7B-F4A31DDC0198", "versionEndExcluding": "17.4.8", "versionStartIncluding": "17.4", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*", "matchCriteriaId": "51DB90D6-C1C4-43B9-8B37-696CB361F37F", "versionEndExcluding": "17.6.3", "versionStartIncluding": "17.6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": ".NET and Visual Studio Elevation of Privilege Vulnerability"}], "id": "CVE-2023-32032", "lastModified": "2024-05-29T02:15:47.723", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 5.5, "source": "secure@microsoft.com", "type": "Primary"}]}, "published": "2023-06-14T00:15:11.790", "references": [{"source": "secure@microsoft.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-32032"}], "sourceIdentifier": "secure@microsoft.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-20"}], "source": "secure@microsoft.com", "type": "Secondary"}]}