Input validation error in Microsoft products - CVE-2023-36796

Vulnerability identifier: #VU80669

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-36796

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the system.

The vulnerability exists due to insufficient validation of user-supplied input in Visual Studio. A remote attacker can trick a victim to open a specially crafted package file and execute arbitrary code on the target system.

.NET
Visual Studio
Microsoft .NET Framework
Amazon Linux AMI
TeleControl Server Basic
dotnet6.0

Install updates from vendor's website.

.NET - addressed in versions 6.0.22, 7.0.11
Visual Studio - addressed in versions 15.9.57, 16.11.30 16.11.34031.81, 17.2.19 17.2.34031.104, 17.4.11 17.4.34031.109, 17.6.7 17.6.34031.178, 17.7.4 17.7.34031.279
Microsoft .NET Framework - addressed in versions 3.0.30729.8957, 4.7.04063.01, 4.7.04063.02, 4.7.04063.05, 4.8.04667.03, 4.8.09186.0
TeleControl Server Basic - update to 3.1.2
dotnet6.0 - update to 6.0.122-1

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2023-36796

• Multiple vulnerabilities in Microsoft Visual Studio
• Multiple vulnerabilities in Siemens Telecontrol Server Basic
• Amazon Linux AMI update for dotnet6.0