Jul 2023: .NET and Visual Studio Elevation of Privilege Vulnerability
CVE-2023-33127 Published on July 11, 2023

.NET and Visual Studio Elevation of Privilege Vulnerability
.NET and Visual Studio Elevation of Privilege Vulnerability

Github Repository Vendor Advisory NVD

Vulnerability Analysis

Exploitation:
NONE
Automatable:
NO
Technical Impact:
PARTIAL

Weakness Type

Insufficient Granularity of Access Control

The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets.


Products Associated with CVE-2023-33127

Want to know whenever a new CVE is published for Microsoft products? stack.watch will email you.

Microsoft Visual Studio 2022
Microsoft Net
Microsoft Visual Studio
Microsoft Powershell

Affected Versions

Microsoft .NET 6.0: Microsoft .NET 7.0: Microsoft Visual Studio 2022 version 17.0: Microsoft Visual Studio 2022 version 17.2: Microsoft Visual Studio 2022 version 17.4: Microsoft Visual Studio 2022 version 17.6: Microsoft PowerShell 7.2: Microsoft PowerShell 7.3:

Vulnerable Packages

The following package name and versions may be associated with CVE-2023-33127

Package Manager Vulnerable Package Versions Fixed In
nuget Microsoft.WindowsDesktop.App.Runtime.win-x86 >= 7.0.0, < 7.0.9 7.0.9
nuget Microsoft.WindowsDesktop.App.Runtime.win-x86 >= 6.0.0, < 6.0.20 6.0.20
nuget Microsoft.WindowsDesktop.App.Runtime.win-x64 >= 6.0.0, < 6.0.20 6.0.20
nuget Microsoft.WindowsDesktop.App.Runtime.win-x64 >= 7.0.0, < 7.0.9 7.0.9
nuget Microsoft.WindowsDesktop.App.Runtime.win-arm64 >= 6.0.0, < 6.0.20 6.0.20
nuget Microsoft.WindowsDesktop.App.Runtime.win-arm64 >= 7.0.0, < 7.0.9 7.0.9

Exploit Probability

EPSS
1.88%
Percentile
79.61%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.