Nov 2023: ASP.NET Core Security Feature Bypass Vulnerability
CVE-2023-36558 Published on November 14, 2023

Products Associated with CVE-2023-36558

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2023-36558 are published in these products:

Affected Versions

Microsoft .NET 6.0:

• Version 6.0.0 and below 6.0.25 is affected.

Microsoft ASP.NET Core 6.0:

• Version 6.0 and below 6.0.25 is affected.

Microsoft .NET 7.0:

• Version 7.0.0 and below 7.0.14 is affected.

Microsoft Visual Studio 2022 version 17.2:

• Version 17.2.0 and below 17.2.22 is affected.

Microsoft .NET 8.0:

• Version 8.0 and below 8.0.0 is affected.

Microsoft Visual Studio 2022 version 17.4:

• Version 17.4.0 and below 17.4.14 is affected.

Microsoft Visual Studio 2022 version 17.6:

• Version 17.6.0 and below 17.6.10 is affected.

Microsoft Visual Studio 2022 version 17.7:

• Version 17.7.0 and below 17.7.7 is affected.

Microsoft ASP.NET Core 7.0:

• Version 7.0.0 and below 7.0.14 is affected.

Microsoft ASP.NET Core 8.0:

• Version 8.0 and below 8.0.0 is affected.

Vulnerable Packages

The following package name and versions may be associated with CVE-2023-36558

Package Manager	Vulnerable Package	Versions	Fixed In
nuget	Microsoft.AspNetCore.Components	>= 6.0.0, <= 6.0.24	6.0.25
nuget	Microsoft.AspNetCore.Components	>= 7.0.0, <= 7.0.13	7.0.14
nuget	Microsoft.AspNetCore.Components	= 8.0.0-rc.2.23480.2	8.0.0

Exploit Probability