ASP.NET Core - Security Feature Bypass Vulnerability

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-457 advisory.

    .NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability (CVE-2023-36049)

    ASP.NET Core - Security Feature Bypass Vulnerability (CVE-2023-36558)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2023:7256 advisory.

  - .NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability (CVE-2023-36049)

  - ASP.NET Core - Security Feature Bypass Vulnerability (CVE-2023-36558)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2023:7258 advisory.

  - .NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability (CVE-2023-36049)

  - ASP.NET Core - Security Feature Bypass Vulnerability (CVE-2023-36558)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-7253 advisory.

    [8.0.100-2.0.1]
    - Update to .NET 8.0

    [8.0.100~rc.2-0.1.0.1]
    - Add support for Oracle Linux

    [8.0.100~rc.2-0.1]
    - Update to .NET 8 RC 2
    - Resolves: RHEL-13790

    [8.0.100~rc.1-0.4]
    - Disable bootstrap
    - Related: RHEL-4074

    [8.0.100~rc.1-0.3]
    - Add backported patches for additional s390x issues
    - Related: RHEL-4074

    [8.0.100~rc.1-0.2]
    - Add patches to fix mono and arm64 issues
    - Include libmono-*.a files in the SDK
    - Fix CI configuration
    - Related: RHEL-4074

    [8.0.100~rc.1-0.1]
    - Update to .NET SDK 8.0.100 RC 1 and Runtime 8.0.0 RC 1
    - Resolves: RHEL-4074

    [8.0.100~preview.7-0.2]
    - Add patch to work around TypeLoadException in Mono
    - Related: RHBZ#2224124

    [8.0.100~preview.7-0.1]
    - Update to .NET SDK 8.0.100 Preview 7 and Runtime 8.0.0 Preview 7

    [8.0.100~preview.6-0.2]
    - Remove lttng and other tracing-specific dependencies from the runtime package

    [8.0.100~preview.6-0.1]
    - Update to .NET SDK 8.0.100 Preview 6 and Runtime 8.0.0 Preview 6

    [8.0.100~preview.5-0.2]
    - Fix release.json and sourcelink references

    [8.0.100~preview.5-0.1]
    - Update to .NET SDK 8.0.100 Preview 5 and Runtime 8.0.0 Preview 5

    [8.0.100~preview.3-0.1]
    - Update to .NET SDK 8.0.100 Preview 3 and Runtime 8.0.0 Preview 3

    [8.0.100~preview.2-0.1]
    - Update to .NET SDK 8.0.100 Preview 2 and Runtime 8.0.0 Preview 2

    [8.0.100~preview.1-0.1]
    - Update to .NET SDK 8.0.100 Preview 1 and Runtime 8.0.0 Preview 1

    [7.0.102-1]
    - Update to .NET SDK 7.0.102 and Runtime 7.0.2

    [7.0.101-1]
    - Update to .NET SDK 7.0.101 and Runtime 7.0.1

    [7.0.100-1]

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-7255 advisory.

    [7.0.114-1.0.1]
    - Update to .NET SDK 7.0.114 and Runtime 7.0.14

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-7257 advisory.

    [6.0.125-1.0.1]
    - Update to .NET SDK 6.0.125 and Runtime 6.0.25
    - Add support for Oracle Linux

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-7258 advisory.

    [6.0.125-1.0.2]
    - Add strict BuildRequires on 6.0.125-1.0.1

    [6.0.125-1.0.1]
    - Update to .NET SDK 6.0.125 and Runtime 6.0.25

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-7256 advisory.

    [7.0.114-1.0.1]
    - Update to .NET SDK 7.0.114 and Runtime 7.0.14

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Microsoft .NET Core SDK installed on the remote host is 6.0.x prior to 6.0.125, 6.0.x prior to 6.0.320, 6.0.x prior to 6.0.417, 7.0.x prior to 7.0.114, 7.0.x prior to 7.0.311, 7.0.x prior to 7.0.404, or 8.0.x to 8.0.100. It is, therefore, affected by multiple vulnerabilities, as follows:

  - An elevation of privilege vulnerability exists in .NET where untrusted URIs provided to   System.Net.WebRequest.Create can be used to inject arbitrary commands to backend FTP servers.
  (CVE-2023-36049)   
  - A security feature bypass vulnerability exists in ASP.NET where an unauthenticated user is able to bypass   validation on Blazor server forms which could trigger unintended actions.(CVE-2023-36558)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:7253 advisory.

  - .NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability (CVE-2023-36049)

  - ASP.NET Core - Security Feature Bypass Vulnerability (CVE-2023-36558)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:7255 advisory.

  - .NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability (CVE-2023-36049)

  - ASP.NET Core - Security Feature Bypass Vulnerability (CVE-2023-36558)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:7257 advisory.

  - .NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability (CVE-2023-36049)

  - ASP.NET Core - Security Feature Bypass Vulnerability (CVE-2023-36558)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by security feature bypass vulnerability as referenced in the vendor advisory.

  - ASP.NET Core - Security Feature Bypass Vulnerability (CVE-2023-36558)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by security feature bypass vulnerability as referenced in the vendor advisory.
  - ASP.NET Core - Security Feature Bypass Vulnerability (CVE-2023-36558)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7253 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    Security Fix(es):

    * dotnet: Arbitrary File Write and Deletion Vulnerability: FormatFtpCommand (CVE-2023-36049)

    * dotnet: ASP.NET Security Feature Bypass Vulnerability in Blazor forms (CVE-2023-36558)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7256 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 7.0.114 and .NET Runtime 7.0.14.

    Security Fix(es):

    * dotnet: Arbitrary File Write and Deletion Vulnerability: FormatFtpCommand (CVE-2023-36049)

    * dotnet: ASP.NET Security Feature Bypass Vulnerability in Blazor forms (CVE-2023-36558)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7254 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    Security Fix(es):

    * dotnet: Arbitrary File Write and Deletion Vulnerability: FormatFtpCommand (CVE-2023-36049)

    * dotnet: ASP.NET Security Feature Bypass Vulnerability in Blazor forms (CVE-2023-36558)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7255 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 7.0.114 and .NET Runtime 7.0.14.


    Security Fix(es):

    * dotnet: Arbitrary File Write and Deletion Vulnerability: FormatFtpCommand (CVE-2023-36049)

    * dotnet: ASP.NET Security Feature Bypass Vulnerability in Blazor forms (CVE-2023-36558)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7258 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 6.0.125 and .NET Runtime 6.0.25.

    Security Fix(es):

    * dotnet: Arbitrary File Write and Deletion Vulnerability: FormatFtpCommand (CVE-2023-36049)

    * dotnet: ASP.NET Security Feature Bypass Vulnerability in Blazor forms (CVE-2023-36558)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7259 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 6.0.125 and .NET Runtime 6.0.25.

    The following packages have been upgraded to a later upstream version: rh-dotnet60-dotnet (6.0.125).
    (BZ#2247677)

    Security Fix(es):

    * dotnet: Arbitrary File Write and Deletion Vulnerability: FormatFtpCommand (CVE-2023-36049)

    * dotnet: ASP.NET Security Feature Bypass Vulnerability in Blazor forms (CVE-2023-36558)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7257 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 6.0.125 and .NET Runtime 6.0.25.

    Security Fix(es):

    * dotnet: Arbitrary File Write and Deletion Vulnerability: FormatFtpCommand (CVE-2023-36049)

    * dotnet: ASP.NET Security Feature Bypass Vulnerability in Blazor forms (CVE-2023-36558)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 23.04 / 23.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6480-1 advisory.

    Barry Dorrans discovered that .NET did not properly implement certain security features for Blazor server     forms. An attacker could possibly use this issue to bypass validation, which could trigger unintended     actions. (CVE-2023-36558)

    Piotr Bazydlo discovered that .NET did not properly handle untrusted URIs provided to     System.Net.WebRequest.Create. An attacker could possibly use this issue to inject arbitrary commands to     backend FTP servers. (CVE-2023-36049)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Microsoft Visual Studio Products are missing security updates. It is, therefore, affected by multiple vulnerabilities:

  - A security feature bypass vulnerability exists. An attacker can exploit this and bypass the security     feature and perform unauthorized actions compromising the integrity of the system/application. (CVE-2023-36558)

  - An elevation of privilege vulnerability. An attacker can exploit this to gain elevated privileges. (CVE-2023-36049)

  - A denial of service (DoS) vulnerability. An attacker can exploit this issue to cause the affected component to     deny system or application services. (CVE-2023-36038, CVE-2023-36042)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
186982	Amazon Linux 2023 : aspnetcore-runtime-6.0, aspnetcore-targeting-pack-6.0, dotnet (ALAS2023-2023-457)	Nessus	Amazon Linux Local Security Checks	critical
186402	Rocky Linux 8 : dotnet7.0 (RLSA-2023:7256)	Nessus	Rocky Linux Local Security Checks	critical
186398	Rocky Linux 8 : dotnet6.0 (RLSA-2023:7258)	Nessus	Rocky Linux Local Security Checks	critical
186393	Oracle Linux 9 : dotnet8.0 (ELSA-2023-7253)	Nessus	Oracle Linux Local Security Checks	critical
186356	Oracle Linux 9 : dotnet7.0 (ELSA-2023-7255)	Nessus	Oracle Linux Local Security Checks	critical
186355	Oracle Linux 9 : dotnet6.0 (ELSA-2023-7257)	Nessus	Oracle Linux Local Security Checks	critical
186242	Oracle Linux 8 : dotnet6.0 (ELSA-2023-7258)	Nessus	Oracle Linux Local Security Checks	critical
186196	Oracle Linux 8 : dotnet7.0 (ELSA-2023-7256)	Nessus	Oracle Linux Local Security Checks	critical
185958	Security Update for .NET Core SDK (November 2023)	Nessus	Windows	critical
185909	AlmaLinux 9 : dotnet8.0 (ALSA-2023:7253)	Nessus	Alma Linux Local Security Checks	critical
185908	AlmaLinux 9 : dotnet7.0 (ALSA-2023:7255)	Nessus	Alma Linux Local Security Checks	critical
185907	AlmaLinux 9 : dotnet6.0 (ALSA-2023:7257)	Nessus	Alma Linux Local Security Checks	critical
185886	Security Update for Microsoft .NET Core (November 2023) (CVE-2023-36558)	Nessus	Windows	medium
185884	Security Update for Microsoft ASP.NET Core (November 2023) (CVE-2023-36558)	Nessus	Windows : Microsoft Bulletins	medium
185808	RHEL 9 : dotnet8.0 (RHSA-2023:7253)	Nessus	Red Hat Local Security Checks	critical
185807	RHEL 8 : dotnet7.0 (RHSA-2023:7256)	Nessus	Red Hat Local Security Checks	critical
185803	RHEL 8 : dotnet8.0 (RHSA-2023:7254)	Nessus	Red Hat Local Security Checks	critical
185802	RHEL 9 : dotnet7.0 (RHSA-2023:7255)	Nessus	Red Hat Local Security Checks	critical
185799	RHEL 8 : dotnet6.0 (RHSA-2023:7258)	Nessus	Red Hat Local Security Checks	critical
185796	RHEL 7 : .NET 6.0 (RHSA-2023:7259)	Nessus	Red Hat Local Security Checks	critical
185794	RHEL 9 : dotnet6.0 (RHSA-2023:7257)	Nessus	Red Hat Local Security Checks	critical
185778	Ubuntu 22.04 LTS / 23.04 / 23.10 : .NET vulnerabilities (USN-6480-1)	Nessus	Ubuntu Local Security Checks	critical
185735	Security Updates for Microsoft Visual Studio Products (November 2023)	Nessus	Windows : Microsoft Bulletins	critical

Detections

Analytics

CVE-2023-36558

medium

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

medium

medium

critical

critical

critical

critical

critical

critical

critical

critical

critical