{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-33170", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "state": "PUBLISHED", "assignerShortName": "microsoft", "dateReserved": "2023-05-17T21:16:44.903Z", "datePublished": "2023-07-11T17:03:13.113Z", "dateUpdated": "2024-08-02T15:39:35.661Z"}, "containers": {"cna": {"title": "ASP.NET and Visual Studio Security Feature Bypass Vulnerability", "datePublic": "2023-07-11T07:00:00+00:00", "affected": [{"vendor": "Microsoft", "product": "Microsoft Visual Studio 2022 version 17.2", "cpes": ["cpe:2.3:a:microsoft:visual_studio_2022:17.2:*:*:*:*:*:*:*"], "platforms": ["Unknown"], "versions": [{"version": "17.2.0", "lessThan": "17.2.17", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Visual Studio 2022 version 17.0", "cpes": ["cpe:2.3:a:microsoft:visual_studio_2022:17.0:*:*:*:*:*:*:*"], "platforms": ["Unknown"], "versions": [{"version": "17.0.0", "lessThan": "17.0.23", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Visual Studio 2022 version 17.4", "cpes": ["cpe:2.3:a:microsoft:visual_studio_2022:17.4:*:*:*:*:*:*:*"], "platforms": ["Unknown"], "versions": [{"version": "17.4.0", "lessThan": "17.4.9", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Visual Studio 2022 version 17.6", "cpes": ["cpe:2.3:a:microsoft:visual_studio:2022:*:*:*:*:*:*:*"], "platforms": ["Unknown"], "versions": [{"version": "17.6.0", "lessThan": "17.6.5", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": ".NET 6.0", "cpes": ["cpe:2.3:a:microsoft:.net:6.0.0:*:*:*:*:*:*:*"], "platforms": ["Unknown"], "versions": [{"version": "6.0.0", "lessThan": "6.0.20", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": ".NET 7.0", "cpes": ["cpe:2.3:a:microsoft:.net:7.0.0:*:*:*:*:*:*:*"], "platforms": ["Unknown"], "versions": [{"version": "7.0.0", "lessThan": "7.0.9", "versionType": "custom", "status": "affected"}]}], "descriptions": [{"value": "ASP.NET and Visual Studio Security Feature Bypass Vulnerability", "lang": "en-US"}], "problemTypes": [{"descriptions": [{"description": "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')", "lang": "en-US", "type": "CWE", "cweId": "CWE-362"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2024-05-29T02:59:18.447Z"}, "references": [{"name": "ASP.NET and Visual Studio Security Feature Bypass Vulnerability", "tags": ["vendor-advisory"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-33170"}, {"url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/EVZVMMCCBBCSCPAW2CRQGOTKIHVFCMRO/"}, {"url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/TLWNIIA2I6YCYVCXYBPBRSZ3UH6KILTG/"}, {"url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/Y3VJRGNYJXGPF5LXUG3NL45QPK2UU6PL/"}, {"url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/O5CFOR6ID2HP45E7ZOGQNX76FPIWP7XR/"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "baseSeverity": "HIGH", "baseScore": 8.1, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C"}}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T15:39:35.661Z"}, "title": "CVE Program Container", "references": [{"name": "ASP.NET and Visual Studio Security Feature Bypass Vulnerability", "tags": ["vendor-advisory", "x_transferred"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-33170"}, {"url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/EVZVMMCCBBCSCPAW2CRQGOTKIHVFCMRO/", "tags": ["x_transferred"]}, {"url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/TLWNIIA2I6YCYVCXYBPBRSZ3UH6KILTG/", "tags": ["x_transferred"]}, {"url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/Y3VJRGNYJXGPF5LXUG3NL45QPK2UU6PL/", "tags": ["x_transferred"]}, {"url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/O5CFOR6ID2HP45E7ZOGQNX76FPIWP7XR/", "tags": ["x_transferred"]}]}]}}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*", "matchCriteriaId": "5730CE86-D1BB-403D-BE28-09BAC686B645", "versionEndExcluding": "6.0.20", "versionStartIncluding": "6.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*", "matchCriteriaId": "4EBEC922-21D4-458E-B9A9-A29CAD09C2D3", "versionEndExcluding": "7.0.9", "versionStartIncluding": "7.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*", "matchCriteriaId": "46E1B01E-2B9A-4666-A680-DED9669FD62B", "versionEndExcluding": "17.0.23", "versionStartIncluding": "17.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*", "matchCriteriaId": "63B52F8F-CF6B-40C5-B4D9-342FA4C3D21C", "versionEndExcluding": "17.2.17", "versionStartIncluding": "17.2.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*", "matchCriteriaId": "45D57A7D-14A4-4916-B029-12E8D3C8EDAD", "versionEndExcluding": "17.4.9", "versionStartIncluding": "17.4.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*", "matchCriteriaId": "D8771AEC-CE62-4C47-922A-A6205FDF3ECE", "versionEndExcluding": "17.6.5", "versionStartIncluding": "17.6.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*", "matchCriteriaId": "E30D0E6F-4AE8-4284-8716-991DFA48CC5D", "vulnerable": true}, {"criteria": "cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*", "matchCriteriaId": "CC559B26-5DFC-4B7A-A27C-B77DE755DFF9", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "ASP.NET and Visual Studio Security Feature Bypass Vulnerability"}], "id": "CVE-2023-33170", "lastModified": "2024-11-21T08:05:02.153", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "[email protected]", "type": "Secondary"}]}, "published": "2023-07-11T18:15:15.660", "references": [{"source": "[email protected]", "tags": ["Mailing List"], "url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/EVZVMMCCBBCSCPAW2CRQGOTKIHVFCMRO/"}, {"source": "[email protected]", "tags": ["Mailing List"], "url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/O5CFOR6ID2HP45E7ZOGQNX76FPIWP7XR/"}, {"source": "[email protected]", "tags": ["Mailing List"], "url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/TLWNIIA2I6YCYVCXYBPBRSZ3UH6KILTG/"}, {"source": "[email protected]", "tags": ["Mailing List"], "url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/Y3VJRGNYJXGPF5LXUG3NL45QPK2UU6PL/"}, {"source": "[email protected]", "tags": ["Patch", "Vendor Advisory"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-33170"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List"], "url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/EVZVMMCCBBCSCPAW2CRQGOTKIHVFCMRO/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List"], "url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/O5CFOR6ID2HP45E7ZOGQNX76FPIWP7XR/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List"], "url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/TLWNIIA2I6YCYVCXYBPBRSZ3UH6KILTG/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List"], "url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/Y3VJRGNYJXGPF5LXUG3NL45QPK2UU6PL/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-33170"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-362"}], "source": "[email protected]", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-362"}], "source": "[email protected]", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2023:4061", "cpe": "cpe:/a:redhat:rhel_dotnet:6.0::el7", "package": "rh-dotnet60-dotnet-0:6.0.120-1.el7_9", "product_name": ".NET Core on Red Hat Enterprise Linux", "release_date": "2023-07-13T00:00:00Z"}, {"advisory": "RHSA-2023:4058", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "dotnet7.0-0:7.0.109-1.el8_8", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2023-07-13T00:00:00Z"}, {"advisory": "RHSA-2023:4059", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "dotnet6.0-0:6.0.120-1.el8_8", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2023-07-13T00:00:00Z"}, {"advisory": "RHSA-2023:4448", "cpe": "cpe:/a:redhat:rhel_eus:8.6", "package": "dotnet6.0-0:6.0.120-1.el8_6", "product_name": "Red Hat Enterprise Linux 8.6 Extended Update Support", "release_date": "2023-08-03T00:00:00Z"}, {"advisory": "RHSA-2023:4057", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "dotnet7.0-0:7.0.109-1.el9_2", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2023-07-13T00:00:00Z"}, {"advisory": "RHSA-2023:4060", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "dotnet6.0-0:6.0.120-1.el9_2", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2023-07-13T00:00:00Z"}, {"advisory": "RHSA-2023:4449", "cpe": "cpe:/a:redhat:rhel_eus:9.0", "package": "dotnet6.0-0:6.0.120-1.el9_0", "product_name": "Red Hat Enterprise Linux 9.0 Extended Update Support", "release_date": "2023-08-03T00:00:00Z"}], "bugzilla": {"description": "dotnet: race condition in Core SignInManager<TUser> PasswordSignInAsync method", "id": "2221854", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2221854"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "status": "verified"}, "cwe": "CWE-362", "details": ["ASP.NET and Visual Studio Security Feature Bypass Vulnerability", "A vulnerability was found in dotNET applications where account lockout maximum failed attempts may not be immediately updated, allowing an attacker to try more passwords and bypass security restrictions. This flaw allows a remote attacker to bypass security features, causing an impact on confidentiality, integrity, and availability."], "name": "CVE-2023-33170", "public_date": "2023-07-11T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2023-33170\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-33170\nhttps://devblogs.microsoft.com/dotnet/july-2023-updates/\nhttps://github.com/advisories/GHSA-25c8-p796-jg6r\nhttps://github.com/dotnet/announcements/issues/264\nhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-33170"], "threat_severity": "Important", "upstream_fix": "dotnet 6.0.20, dotnet 7.0.9"}