{"id":"CVE-2023-32032","aliases":["ALPINE-CVE-2023-32032","ALSA-2023:3592","ALSA-2023:3593","BIT-dotnet-2023-32032","BIT-dotnet-sdk-2023-32032","EUVD-2023-36319","GHSA-q85v-668x-6fjr","RHSA-2023:3592","RHSA-2023:3593","RLSA-2023:3593","UBUNTU-CVE-2023-32032","USN-6161-1"],"status":"published","title":".NET and Visual Studio Elevation of Privilege Vulnerability","description":".NET and Visual Studio Elevation of Privilege Vulnerability","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H/E:P/RL:O/RC:C","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.006,"percentile":0.49019,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2023-06-13T00:00:00Z","modified":"2026-11-03T06:32:59Z","fixes":[{"ecosystem":"Alpine:v3.18","package":"dotnet7-build","fixed_in":["7.0.107-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"dotnet7-build","fixed_in":["7.0.107-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"dotnet7-runtime","fixed_in":["7.0.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"dotnet7-runtime","fixed_in":["7.0.7-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"dotnet","fixed_in":["7.0.7"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"dotnet-sdk","fixed_in":["7.0.7"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"dotnet7","fixed_in":["7.0.107-0ubuntu1~22.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.18","package":"dotnet7-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.107-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"dotnet7-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.107-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"dotnet7-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"dotnet7-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.7-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"aspnetcore-runtime-7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.7-1.el9_2"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"aspnetcore-targeting-pack-7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.7-1.el9_2"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"dotnet-apphost-pack-7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.7-1.el9_2"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"dotnet-host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.7-1.el9_2"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"dotnet-hostfxr-7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.7-1.el9_2"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"dotnet-runtime-7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.7-1.el9_2"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"dotnet-sdk-7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.107-1.el9_2"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"dotnet-sdk-7.0-source-built-artifacts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.107-1.el9_2"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"dotnet-targeting-pack-7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.7-1.el9_2"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"dotnet-templates-7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.107-1.el9_2"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"netstandard-targeting-pack-2.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.107-1.el9_2"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"aspnetcore-runtime-7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.7-1.el8_8"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"aspnetcore-targeting-pack-7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.7-1.el8_8"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"dotnet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.107-1.el8_8"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"dotnet-apphost-pack-7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.7-1.el8_8"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"dotnet-host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.7-1.el8_8"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"dotnet-hostfxr-7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.7-1.el8_8"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"dotnet-runtime-7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.7-1.el8_8"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"dotnet-sdk-7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.107-1.el8_8"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"dotnet-sdk-7.0-source-built-artifacts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.107-1.el8_8"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"dotnet-targeting-pack-7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.7-1.el8_8"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"dotnet-templates-7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.107-1.el8_8"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"netstandard-targeting-pack-2.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.107-1.el8_8"}]}],"bundled":5},{"source":"osv","ecosystem":"Bitnami","package":"dotnet","ranges":[{"type":"SEMVER","events":[{"introduced":"7.0.0"},{"fixed":"7.0.7"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"dotnet-sdk","ranges":[{"type":"SEMVER","events":[{"introduced":"7.0.0"},{"fixed":"7.0.7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"aspnetcore-runtime-7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.7-1.el9_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"aspnetcore-targeting-pack-7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.7-1.el9_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dotnet-apphost-pack-7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.7-1.el9_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dotnet-apphost-pack-7.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.7-1.el9_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dotnet-host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.7-1.el9_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dotnet-host-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.7-1.el9_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dotnet-hostfxr-7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.7-1.el9_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dotnet-hostfxr-7.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.7-1.el9_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dotnet-runtime-7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.7-1.el9_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dotnet-runtime-7.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.7-1.el9_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dotnet-sdk-7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.107-1.el9_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dotnet-sdk-7.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.107-1.el9_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dotnet-targeting-pack-7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.7-1.el9_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dotnet-templates-7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.107-1.el9_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dotnet7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.107-1.el9_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dotnet7.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.107-1.el9_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dotnet7.0-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.107-1.el9_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"netstandard-targeting-pack-2.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.107-1.el9_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"dotnet-apphost-pack-7.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.7-1.el9_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"dotnet-host-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.7-1.el9_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"dotnet-hostfxr-7.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.7-1.el9_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"dotnet-runtime-7.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.7-1.el9_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"dotnet-sdk-7.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.107-1.el9_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"dotnet-sdk-7.0-source-built-artifacts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.107-1.el9_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"dotnet7.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.107-1.el9_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"dotnet7.0-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.107-1.el9_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"aspnetcore-runtime-7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.7-1.el8_8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"aspnetcore-targeting-pack-7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.7-1.el8_8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.107-1.el8_8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-apphost-pack-7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.7-1.el8_8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-apphost-pack-7.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.7-1.el8_8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.7-1.el8_8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-host-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.7-1.el8_8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-hostfxr-7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.7-1.el8_8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-hostfxr-7.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.7-1.el8_8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-runtime-7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.7-1.el8_8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-runtime-7.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.7-1.el8_8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-sdk-7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.107-1.el8_8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-sdk-7.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.107-1.el8_8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-targeting-pack-7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.7-1.el8_8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-templates-7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.107-1.el8_8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.107-1.el8_8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet7.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.107-1.el8_8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet7.0-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.107-1.el8_8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"netstandard-targeting-pack-2.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.107-1.el8_8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"dotnet-apphost-pack-7.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.7-1.el8_8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"dotnet-host-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.7-1.el8_8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"dotnet-hostfxr-7.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.7-1.el8_8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"dotnet-runtime-7.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.7-1.el8_8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"dotnet-sdk-7.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.107-1.el8_8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"dotnet-sdk-7.0-source-built-artifacts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.107-1.el8_8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"dotnet7.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.107-1.el8_8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"dotnet7.0-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.107-1.el8_8"}]}],"bundled":5},{"source":"osv","ecosystem":"Rocky Linux:8","package":"dotnet7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.107-1.el8_8"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"dotnet7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.107-0ubuntu1~22.04.1"}]}],"versions":["7.0.105-0ubuntu1~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"dotnet6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.118-0ubuntu1~22.04.1"}]}],"versions":["6.0.108-0ubuntu1~22.04.1","6.0.109-0ubuntu1~22.04.1","6.0.110-0ubuntu1~22.04.1","6.0.111-0ubuntu1~22.04.1","6.0.113-0ubuntu1~22.04.1","6.0.116-0ubuntu1~22.04.1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"dotnet7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.107-0ubuntu1~22.04.1"}]}],"versions":["7.0.105-0ubuntu1~22.04.1"],"bundled":5}],"products":[{"vendor":"microsoft","product":".net"},{"vendor":"microsoft","product":".net 7.0"},{"vendor":"microsoft","product":"microsoft visual studio 2022 version 17.0"},{"vendor":"microsoft","product":"microsoft visual studio 2022 version 17.2"},{"vendor":"microsoft","product":"microsoft visual studio 2022 version 17.4"},{"vendor":"microsoft","product":"microsoft visual studio 2022 version 17.6"},{"vendor":"microsoft","product":"powershell 7.3"},{"vendor":"microsoft","product":"visual_studio_2022"}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-32032","tags":["vendor-advisory","x_transferred","Patch","Vendor Advisory","advisory","fix","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-32032","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-q85v-668x-6fjr"},{"url":"https://security.alpinelinux.org/vuln/CVE-2023-32032","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:3592","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-24936","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-29331","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-29337","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-32032","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-33128","tags":["report"]},{"url":"https://bugzilla.redhat.com/2192438","tags":["report"]},{"url":"https://bugzilla.redhat.com/2212615","tags":["report"]},{"url":"https://bugzilla.redhat.com/2212617","tags":["report"]},{"url":"https://bugzilla.redhat.com/2212618","tags":["report"]},{"url":"https://bugzilla.redhat.com/2213703","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2023-3592.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:3593","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2023-3593.html","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2192438","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2212615","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2212617","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2212618","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2213703","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_3592.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-24936","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-24936","tags":["advisory"]},{"url":"https://github.com/dotnet/core/blob/c73158b8ef08db362585f9ed16b97c1d1372c666/release-notes/6.0/6.0.18/6.0.18.md","tags":["article"]},{"url":"https://github.com/dotnet/core/blob/c73158b8ef08db362585f9ed16b97c1d1372c666/release-notes/7.0/7.0.7/7.0.7.md","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-29331","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-29331","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-29337","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-29337","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-32032","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-33128","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-33128","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_3593.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2023:3593","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-32032","tags":["report"]},{"url":"https://devblogs.microsoft.com/dotnet/june-2023-updates/","tags":["report"]},{"url":"https://devblogs.microsoft.com/dotnet/dotnet-framework-june-2023-security-and-quality-rollup/","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6161-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-24936","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-29331","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-29337","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-33128","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2023-32032","title":".NET and Visual Studio Elevation of Privilege Vulnerability","description":".NET and Visual Studio Elevation of Privilege Vulnerability","status":"published","published":"2023-06-13T23:26:21.832Z","modified":"2025-01-01T01:44:11.443Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H/E:P/RL:O/RC:C","level":"medium","assessor":"cna"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:35:29.01154Z"}],"euvd":[{"id":"EUVD-2023-36319","description":".NET and Visual Studio Elevation of Privilege Vulnerability","status":"published","published":"2023-06-13T23:26:21Z","modified":"2025-01-01T01:44:11Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H/E:P/RL:O/RC:C","level":"medium"}],"updated_at":"2026-11-03T00:04:30.464531Z"}],"ghsa":[{"id":"GHSA-q85v-668x-6fjr","title":".NET and Visual Studio Elevation of Privilege Vulnerability","description":".NET and Visual Studio Elevation of Privilege Vulnerability","status":"published","published":"2023-06-14T00:30:41Z","modified":"2024-04-04T04:49:06Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T14:56:27.331112Z"}],"nvd":[{"id":"CVE-2023-32032","description":".NET and Visual Studio Elevation of Privilege Vulnerability","status":"published","published":"2023-06-14T00:15:11.79Z","modified":"2026-06-17T05:57:54.507Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:08:06.335469Z"}],"osv":[{"id":"ALPINE-CVE-2023-32032","description":".NET and Visual Studio Elevation of Privilege Vulnerability","status":"published","published":"2023-06-14T00:15:11.79Z","modified":"2026-11-03T06:32:59.0820534Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H","level":"medium"}],"updated_at":"2026-11-03T07:16:09.603409Z"},{"id":"CVE-2023-32032","description":".NET and Visual Studio Elevation of Privilege Vulnerability","status":"published","published":"2023-06-14T00:15:11.79Z","modified":"2026-10-24T10:30:17.158201674Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:31.790231Z"},{"id":"RHSA-2023:3592","title":"Red Hat Security Advisory: .NET 7.0 security, bug fix, and enhancement update","status":"published","published":"2024-09-16T12:14:01Z","modified":"2026-06-26T12:22:20.900558345Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:11.154197Z"},{"id":"RHSA-2023:3593","title":"Red Hat Security Advisory: .NET 7.0 security, bug fix, and enhancement update","status":"published","published":"2024-09-16T12:14:12Z","modified":"2026-06-26T12:22:20.850202664Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:11.154197Z"},{"id":"RLSA-2023:3593","title":"Important: .NET 7.0 security, bug fix, and enhancement update","description":".NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.\n\nNew versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 7.0.107 and .NET Runtime 7.0.7.\n\nThe following packages have been upgraded to a later upstream version: dotnet7.0 (7.0.107). (BZ#2211876)\n\nSecurity Fix(es):\n\n* dotnet: .NET Kestrel: Denial of Service processing X509 Certificates (CVE-2023-29331)\n\n* dotnet: vulnerability exists in NuGet where a potential race condition can lead to a symlink attack (CVE-2023-29337)\n\n* dotnet: Elevation of privilege - TarFile.ExtractToDirectory ignores extraction directory argument (CVE-2023-32032)\n\n* dotnet: Remote Code Execution - Source generators issue can lead to a crash due to unmanaged heap corruption (CVE-2023-33128)\n\n* dotnet: Bypass restrictions when deserializing a DataSet or DataTable from XML (CVE-2023-24936)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2023-08-31T16:54:34.048467Z","modified":"2026-02-04T12:15:09.279721Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:24.63379Z"},{"id":"UBUNTU-CVE-2023-32032","description":".NET and Visual Studio Elevation of Privilege Vulnerability","status":"published","published":"2023-06-13T00:00:00Z","modified":"2026-02-04T03:31:42.07329Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H","level":"medium"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T16:54:20.997471Z"},{"id":"ALSA-2023:3592","title":"Important: .NET 7.0 security, bug fix, and enhancement update","description":".NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.\n\nNew versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 7.0.107 and .NET Runtime 7.0.7.\n\nThe following packages have been upgraded to a later upstream version: dotnet7.0 (7.0.107). (BZ#2211877)\n\nSecurity Fix(es):\n\n* dotnet: .NET Kestrel: Denial of Service processing X509 Certificates (CVE-2023-29331)\n* dotnet: vulnerability exists in NuGet where a potential race condition can lead to a symlink attack (CVE-2023-29337)\n* dotnet: Elevation of privilege - TarFile.ExtractToDirectory ignores extraction directory argument (CVE-2023-32032)\n* dotnet: Remote Code Execution - Source generators issue can lead to a crash due to unmanaged heap corruption (CVE-2023-33128)\n* dotnet: Bypass restrictions when deserializing a DataSet or DataTable from XML (CVE-2023-24936)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2023-06-14T00:00:00Z","modified":"2026-10-29T11:31:25.20004065Z","updated_at":"2026-11-02T15:27:52.091404Z"},{"id":"ALSA-2023:3593","title":"Important: .NET 7.0 security, bug fix, and enhancement update","description":".NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.\n\nNew versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 7.0.107 and .NET Runtime 7.0.7.\n\nThe following packages have been upgraded to a later upstream version: dotnet7.0 (7.0.107). (BZ#2211876)\n\nSecurity Fix(es):\n\n* dotnet: .NET Kestrel: Denial of Service processing X509 Certificates (CVE-2023-29331)\n* dotnet: vulnerability exists in NuGet where a potential race condition can lead to a symlink attack (CVE-2023-29337)\n* dotnet: Elevation of privilege - TarFile.ExtractToDirectory ignores extraction directory argument (CVE-2023-32032)\n* dotnet: Remote Code Execution - Source generators issue can lead to a crash due to unmanaged heap corruption (CVE-2023-33128)\n* dotnet: Bypass restrictions when deserializing a DataSet or DataTable from XML (CVE-2023-24936)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2023-06-14T00:00:00Z","modified":"2026-10-29T11:02:09.895213057Z","updated_at":"2026-11-02T15:27:52.091404Z"},{"id":"BIT-dotnet-2023-32032","title":".NET and Visual Studio Elevation of Privilege Vulnerability","description":".NET and Visual Studio Elevation of Privilege Vulnerability","status":"published","published":"2024-03-06T10:55:37.681Z","modified":"2026-09-08T08:46:47.412518181Z","updated_at":"2026-11-02T15:28:29.152062Z"},{"id":"BIT-dotnet-sdk-2023-32032","title":".NET and Visual Studio Elevation of Privilege Vulnerability","description":".NET and Visual Studio Elevation of Privilege Vulnerability","status":"published","published":"2024-03-06T10:55:51.173Z","modified":"2026-09-08T08:46:41.983968944Z","updated_at":"2026-11-02T15:28:29.152062Z"},{"id":"USN-6161-1","title":"dotnet6, dotnet7 vulnerabilities","description":"It was discovered that .NET did not properly enforce certain\nrestrictions when deserializing a DataSet or DataTable from\nXML. An attacker could possibly use this issue to elevate their\nprivileges. (CVE-2023-24936)\n\nKevin Jones discovered that .NET did not properly handle the\nAIA fetching process for X.509 client certificates. An attacker\ncould possibly use this issue to cause a denial of service.\n(CVE-2023-29331)\n\nKalle Niemitalo discovered that the .NET package manager,\nNuGet, was susceptible to a potential race condition. An\nattacker could possibly use this issue to perform remote\ncode execution. (CVE-2023-29337)\n\nTom Deseyn discovered that .NET did not properly process certain\narguments when extracting the contents of a tar file. An attacker\ncould possibly use this issue to elevate their privileges. This\nissue only affected the dotnet7 package. (CVE-2023-32032)\n\nIt was discovered that .NET did not properly handle memory in\ncertain circumstances. An attacker could possibly use this issue\nto cause a denial of service or perform remote code execution.\n(CVE-2023-33128)\n","status":"published","published":"2023-06-13T20:33:22Z","modified":"2026-02-10T04:43:09Z","updated_at":"2026-11-02T16:58:16.738762Z"}]}}