Information disclosure in Microsoft products - CVE-2023-35391

Vulnerability identifier: #VU79255

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-35391

CWE-ID: CWE-200

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application in ASP.NET Core SignalR and Visual Studio. A local user can gain unauthorized access to sensitive information on the system.

.NET
Robotic Process Automation for Cloud Pak
Visual Studio
ASP.NET Core
IBM Robotic Process Automation

Install updates from vendor's website.

.NET - addressed in versions 6.0.21, 7.0.10
Visual Studio - addressed in versions 17.2.18 17.2.33927.290, 17.4.10 17.4.33927.135, 17.6.6 17.6.33927.249
ASP.NET Core - update to 2.1.40
IBM Robotic Process Automation - addressed in versions 21.0.7.9, 23.0.10
Robotic Process Automation for Cloud Pak - addressed in versions 21.0.7.9, 23.0.10

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35391

• Information disclosure in Microsoft ASP.NET Core SignalR and Visual Studio
• Information disclosure in IBM Robotic Process Automation