ASP.NET Core Denial of Service Vulnerability

The version of Microsoft .NET Core SDK installed on the remote host is 8.0.x prior to 8.0.100. It is, therefore, affected by a denial of service (DoS) vulnerability in ASP.NET IIS where a remote unauthenticated user can issue specially crafted requests to a .NET application which may result in denial of service.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by a denial of service as referenced in the vendor advisory.

  - ASP.NET Core Denial of Service Vulnerability (CVE-2023-36038)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by a denial of service as referenced in the vendor advisory.
  - ASP.NET Core Denial of Service Vulnerability (CVE-2023-36038)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Microsoft Visual Studio Products are missing security updates. It is, therefore, affected by multiple vulnerabilities:

  - A security feature bypass vulnerability exists. An attacker can exploit this and bypass the security     feature and perform unauthorized actions compromising the integrity of the system/application. (CVE-2023-36558)

  - An elevation of privilege vulnerability. An attacker can exploit this to gain elevated privileges. (CVE-2023-36049)

  - A denial of service (DoS) vulnerability. An attacker can exploit this issue to cause the affected component to     deny system or application services. (CVE-2023-36038, CVE-2023-36042)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
185959	.NET Core SDK Denial of Service (CVE-2023-36038)	Nessus	Windows	high
185885	Security Update for Microsoft .NET Core (November 2023) (CVE-2023-36038)	Nessus	Windows	high
185883	Security Update for Microsoft ASP.NET Core (November 2023) (CVE-2023-36038)	Nessus	Windows : Microsoft Bulletins	high
185735	Security Updates for Microsoft Visual Studio Products (November 2023)	Nessus	Windows : Microsoft Bulletins	critical

Detections

Analytics

CVE-2023-36038

high

Tenable Plugins

high

high

high

critical