7.5
High
Exploited
CVE-2023-38180 Microsoft .NET Core and Visual Studio Denial-of-Service Vulnerability
Active exploitation observed
· CISA KEV catalogue
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Ransomware campaigns
Not observed so far
Description
.NET and Visual Studio Denial of Service Vulnerability
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| ASP.NET Core 2.1 2.0 | 2.0 → < 2.1.40 | 2.1.40 |
| .NET 6.0 6.0 | 6.0.0 → < 6.0.21 | 6.0.21 |
| .NET 7.0 7.0 | 7.0.0 → < 7.0.10 | 7.0.10 |
| Microsoft Visual Studio 2022 version 17.2 17.2 | 17.2.0 → < 17.2.18 | 17.2.18 |
| Microsoft Visual Studio 2022 version 17.4 17.4 | 17.4.0 → < 17.4.10 | 17.4.10 |
| Microsoft Visual Studio 2022 version 17.6 17.6 | 17.6.0 → < 17.6.6 | 17.6.6 |
References
- .NET and Visual Studio Denial of Service Vulnerability msrc.microsoft.com
Timeline
- Published
- Added to the KEV catalogue
- Last modified
Other CVEs of ASP.NET Core 2.1
The 5 CVEs of ASP.NET Core 2.1 →
CVE-2023-35391
ASP.NET Core SignalR and Visual Studio Information Disclosure Vulnerability
6.2
Medium
CVE-2021-34532
ASP.NET Core and Visual Studio Information Disclosure Vulnerability
5.5
Medium
CVE-2020-1045
A security feature bypass vulnerability exists in the way Microsoft ASP.NET Core parses encoded cookie names. The…
7.5
High
CVE-2020-1597
A denial of service vulnerability exists when ASP.NET Core improperly handles web requests
Not rated