Jul 2023: ASP.NET and Visual Studio Security Feature Bypass Vulnerability
CVE-2023-33170 Published on July 11, 2023

ASP.NET and Visual Studio Security Feature Bypass Vulnerability
ASP.NET and Visual Studio Security Feature Bypass Vulnerability

Github Repository Vendor Advisory NVD

Vulnerability Analysis

Exploitation:
NONE
Automatable:
NO
Technical Impact:
TOTAL

Weakness Type

What is a Race Condition Vulnerability?

The program contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.

CVE-2023-33170 has been classified to as a Race Condition vulnerability or weakness.


Products Associated with CVE-2023-33170

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2023-33170 are published in these products:

Microsoft Visual Studio 2022
Microsoft Net
Fedora Project Fedora
Microsoft Visual Studio

Affected Versions

Microsoft Visual Studio 2022 version 17.2: Microsoft Visual Studio 2022 version 17.0: Microsoft Visual Studio 2022 version 17.4: Microsoft Visual Studio 2022 version 17.6: Microsoft .NET 6.0: Microsoft .NET 7.0:

Vulnerable Packages

The following package name and versions may be associated with CVE-2023-33170

Package Manager Vulnerable Package Versions Fixed In
nuget Microsoft.AspNetCore.App.Runtime.linux-arm64 >= 7.0.0, < 7.0.9 7.0.9
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-arm >= 7.0.0, < 7.0.9 7.0.9
nuget Microsoft.AspNetCore.Identity < 2.1.39 2.1.39
nuget Microsoft.AspNet.Identity.Owin < 2.2.4 2.2.4
nuget Microsoft.AspNetCore.App.Runtime.linux-arm < 6.0.20 6.0.20
nuget Microsoft.AspNetCore.App.Runtime.linux-arm64 < 6.0.20 6.0.20
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-arm < 6.0.20 6.0.20
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 < 6.0.20 6.0.20
nuget Microsoft.AspNetCore.App.Runtime.linux-x64 < 6.0.20 6.0.20
nuget Microsoft.AspNetCore.App.Runtime.osx-x64 < 6.0.20 6.0.20
nuget Microsoft.AspNetCore.App.Runtime.win-arm < 6.0.20 6.0.20
nuget Microsoft.AspNetCore.App.Runtime.win-arm64 < 6.0.20 6.0.20
nuget Microsoft.AspNetCore.App.Runtime.win-x64 < 6.0.20 6.0.20
nuget Microsoft.AspNetCore.App.Runtime.win-x86 < 6.0.20 6.0.20
nuget Microsoft.AspNetCore.App.Runtime.win-x86 >= 7.0.0, < 7.0.9 7.0.9
nuget Microsoft.AspNetCore.App.Runtime.win-x64 >= 7.0.0, < 7.0.9 7.0.9
nuget Microsoft.AspNetCore.App.Runtime.win-arm64 >= 7.0.0, < 7.0.9 7.0.9
nuget Microsoft.AspNetCore.App.Runtime.win-arm >= 7.0.0, < 7.0.9 7.0.9
nuget Microsoft.AspNetCore.App.Runtime.osx-x64 >= 7.0.0, < 7.0.9 7.0.9
nuget Microsoft.AspNetCore.App.Runtime.osx-arm64 < 7.0.9 7.0.9
nuget Microsoft.AspNetCore.App.Runtime.linux-x64 >= 7.0.0, < 7.0.9 7.0.9
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-x64 < 7.0.9 7.0.9
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 >= 7.0.0, < 7.0.9 7.0.9
nuget Microsoft.AspNetCore.App.Runtime.linux-arm >= 7.0.0, < 7.0.9 7.0.9

Exploit Probability

EPSS
1.99%
Percentile
80.83%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.