CVE-2024-43499 - OpenCVE

.NET and Visual Studio Denial of Service Vulnerability

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Microsoft	.net Visual Studio

No data.

No data.

References

Link	Providers
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43499
https://nvd.nist.gov/vuln/detail/CVE-2024-43499
https://www.cve.org/CVERecord?id=CVE-2024-43499

History

Thu, 14 Nov 2024 19:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-409

Wed, 13 Nov 2024 17:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 13 Nov 2024 13:45:00 +0000

Type	Values Removed	Values Added
References		https://nvd.nist.gov/vuln/detail/CVE-2024-43499 https://www.cve.org/CVERecord?id=CVE-2024-43499
Metrics	threat_severity `None`	threat_severity `Important`

Tue, 12 Nov 2024 18:00:00 +0000

Type	Values Removed	Values Added
Description		.NET and Visual Studio Denial of Service Vulnerability
Title		.NET and Visual Studio Denial of Service Vulnerability
First Time appeared		Microsoft Microsoft .net Microsoft visual Studio
Weaknesses		CWE-606
CPEs		cpe:2.3:a:microsoft:.net:9.0.0:::::::* cpe:2.3:a:microsoft:visual_studio:2022:::::::*
Vendors & Products		Microsoft Microsoft .net Microsoft visual Studio
References		https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43499
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C'}`

MITRE

Status: PUBLISHED

Assigner: microsoft

Published: 2024-11-12T17:53:35.848Z

Updated: 2024-11-14T21:26:42.007Z

Reserved: 2024-08-14T01:08:33.522Z

Link: CVE-2024-43499

Vulnrichment

Updated: 2024-11-13T16:28:28.142Z

NVD

Status : Awaiting Analysis

Published: 2024-11-12T18:15:24.363

Modified: 2024-11-14T19:15:06.850

Link: CVE-2024-43499

Redhat

Severity : Important

Publid Date: 2024-11-12T00:00:00Z

Links: CVE-2024-43499 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-43499", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "state": "PUBLISHED", "assignerShortName": "microsoft", "dateReserved": "2024-08-14T01:08:33.522Z", "datePublished": "2024-11-12T17:53:35.848Z", "dateUpdated": "2024-11-14T21:26:42.007Z"}, "containers": {"cna": {"title": ".NET and Visual Studio Denial of Service Vulnerability", "datePublic": "2024-11-12T08:00:00+00:00", "affected": [{"vendor": "Microsoft", "product": "Microsoft Visual Studio 2022 version 17.6", "cpes": ["cpe:2.3:a:microsoft:visual_studio:2022:*:*:*:*:*:*:*"], "platforms": ["Unknown"], "versions": [{"version": "17.6.0", "lessThan": "17.6.21", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Visual Studio 2022 version 17.10", "cpes": ["cpe:2.3:a:microsoft:visual_studio:2022:*:*:*:*:*:*:*"], "platforms": ["Unknown"], "versions": [{"version": "17.10", "lessThan": "17.10.9", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Visual Studio 2022 version 17.8", "cpes": ["cpe:2.3:a:microsoft:visual_studio:2022:*:*:*:*:*:*:*"], "platforms": ["Unknown"], "versions": [{"version": "17.8.0", "lessThan": "17.8.16", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Visual Studio 2022 version 17.11", "cpes": ["cpe:2.3:a:microsoft:visual_studio:2022:*:*:*:*:*:*:*"], "platforms": ["Unknown"], "versions": [{"version": "17.11", "lessThan": "17.11.6", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": ".NET 9.0", "cpes": ["cpe:2.3:a:microsoft:.net:9.0.0:*:*:*:*:*:*:*"], "platforms": ["Unknown"], "versions": [{"version": "9.0.0", "lessThan": "9.0.0", "versionType": "custom", "status": "affected"}]}], "descriptions": [{"value": ".NET and Visual Studio Denial of Service Vulnerability", "lang": "en-US"}], "problemTypes": [{"descriptions": [{"description": "CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)", "lang": "en-US", "type": "CWE", "cweId": "CWE-409"}, {"description": "CWE-606: Unchecked Input for Loop Condition", "lang": "en-US", "type": "CWE", "cweId": "CWE-606"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2024-11-14T21:26:42.007Z"}, "references": [{"name": ".NET and Visual Studio Denial of Service Vulnerability", "tags": ["vendor-advisory"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43499"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "baseSeverity": "HIGH", "baseScore": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C"}}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-11-13T16:28:19.318382Z", "id": "CVE-2024-43499", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-13T16:28:33.031Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-43499", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-11-13T16:28:19.318382Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-13T16:28:28.142Z"}}], "cna": {"title": ".NET and Visual Studio Denial of Service Vulnerability", "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C"}, "scenarios": [{"lang": "en-US", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:microsoft:visual_studio:2022:*:*:*:*:*:*:*"], "vendor": "Microsoft", "product": "Microsoft Visual Studio 2022 version 17.6", "versions": [{"status": "affected", "version": "17.6.0", "lessThan": "17.6.21", "versionType": "custom"}], "platforms": ["Unknown"]}, {"cpes": ["cpe:2.3:a:microsoft:visual_studio:2022:*:*:*:*:*:*:*"], "vendor": "Microsoft", "product": "Microsoft Visual Studio 2022 version 17.10", "versions": [{"status": "affected", "version": "17.10", "lessThan": "17.10.9", "versionType": "custom"}], "platforms": ["Unknown"]}, {"cpes": ["cpe:2.3:a:microsoft:visual_studio:2022:*:*:*:*:*:*:*"], "vendor": "Microsoft", "product": "Microsoft Visual Studio 2022 version 17.8", "versions": [{"status": "affected", "version": "17.8.0", "lessThan": "17.8.16", "versionType": "custom"}], "platforms": ["Unknown"]}, {"cpes": ["cpe:2.3:a:microsoft:visual_studio:2022:*:*:*:*:*:*:*"], "vendor": "Microsoft", "product": "Microsoft Visual Studio 2022 version 17.11", "versions": [{"status": "affected", "version": "17.11", "lessThan": "17.11.6", "versionType": "custom"}], "platforms": ["Unknown"]}, {"cpes": ["cpe:2.3:a:microsoft:.net:9.0.0:*:*:*:*:*:*:*"], "vendor": "Microsoft", "product": ".NET 9.0", "versions": [{"status": "affected", "version": "9.0.0", "lessThan": "9.0.0", "versionType": "custom"}], "platforms": ["Unknown"]}], "datePublic": "2024-11-12T08:00:00+00:00", "references": [{"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43499", "name": ".NET and Visual Studio Denial of Service Vulnerability", "tags": ["vendor-advisory"]}], "descriptions": [{"lang": "en-US", "value": ".NET and Visual Studio Denial of Service Vulnerability"}], "problemTypes": [{"descriptions": [{"lang": "en-US", "type": "CWE", "cweId": "CWE-409", "description": "CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)"}, {"lang": "en-US", "type": "CWE", "cweId": "CWE-606", "description": "CWE-606: Unchecked Input for Loop Condition"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2024-11-14T21:26:42.007Z"}}}, "cveMetadata": {"cveId": "CVE-2024-43499", "state": "PUBLISHED", "dateUpdated": "2024-11-14T21:26:42.007Z", "dateReserved": "2024-08-14T01:08:33.522Z", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "datePublished": "2024-11-12T17:53:35.848Z", "assignerShortName": "microsoft"}, "dataVersion": "5.1"}