CVE-2023-21538 - Vulnerability Details - OpenCVE

.NET Denial of Service Vulnerability

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Fedoraproject	Fedora
Microsoft	.net Powershell
Redhat	Enterprise Linux Rhel Dotnet

Configuration 1 [-]

OR	cpe:2.3:a:microsoft:.net:6.0.0:-::::::
	cpe:2.3:a:microsoft:powershell:7.2:::::::*

Configuration 2 [-]

OR	cpe:2.3:o:fedoraproject:fedora:36:::::::*
	cpe:2.3:o:fedoraproject:fedora:37:::::::*

Package	CPE	Advisory	Released Date
.NET Core on Red Hat Enterprise Linux
rh-dotnet60-dotnet-0:6.0.113-1.el7_9	cpe:/a:redhat:rhel_dotnet:6.0::el7	RHSA-2023:0078	2023-01-11T00:00:00Z
Red Hat Enterprise Linux 8
dotnet6.0-0:6.0.113-1.el8_7	cpe:/a:redhat:enterprise_linux:8	RHSA-2023:0079	2023-01-11T00:00:00Z
Red Hat Enterprise Linux 9
dotnet6.0-0:6.0.113-1.el9_1	cpe:/a:redhat:enterprise_linux:9	RHSA-2023:0077	2023-01-11T00:00:00Z

References

Link	Providers
https://github.com/dotnet/core/blob/main/release-notes/6.0/6.0.13/6.0.13.md
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21538
https://nvd.nist.gov/vuln/detail/CVE-2023-21538
https://www.cve.org/CVERecord?id=CVE-2023-21538

History

Wed, 01 Jan 2025 01:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 01 Jan 2025 00:45:00 +0000

Type	Values Removed	Values Added
CPEs	cpe:2.3:a:microsoft:.net:6.0.0:::::::*

MITRE

Status: PUBLISHED

Assigner: microsoft

Published: 2023-01-10T00:00:00

Updated: 2025-01-01T00:35:32.962Z

Reserved: 2022-12-01T00:00:00

Link: CVE-2023-21538

Vulnrichment

Updated: 2024-08-02T09:44:01.057Z

NVD

Status : Modified

Published: 2023-01-10T22:15:14.837

Modified: 2024-11-21T07:43:02.130

Link: CVE-2023-21538

Redhat

Severity : Moderate

Publid Date: 2023-01-10T00:00:00Z

Links: CVE-2023-21538 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2023-21538", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "assignerShortName": "microsoft", "dateUpdated": "2025-01-01T00:35:32.962Z", "dateReserved": "2022-12-01T00:00:00", "datePublished": "2023-01-10T00:00:00"}, "containers": {"cna": {"title": ".NET Denial of Service Vulnerability", "datePublic": "2023-01-10T08:00:00+00:00", "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0.0", "versionEndExcluding": "6.0.13"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:powershell:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.2.0", "versionEndExcluding": "7.2.9"}]}]}], "affected": [{"vendor": "Microsoft", "product": ".NET 6.0", "platforms": ["Unknown"], "versions": [{"version": "6.0.0", "lessThan": "6.0.13", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "PowerShell 7.2", "platforms": ["Unknown"], "versions": [{"version": "7.2.0", "lessThan": "7.2.9", "versionType": "custom", "status": "affected"}]}], "descriptions": [{"value": ".NET Denial of Service Vulnerability", "lang": "en-US"}], "problemTypes": [{"descriptions": [{"description": "CWE-502: Deserialization of Untrusted Data", "lang": "en-US", "type": "CWE", "cweId": "CWE-502"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2025-01-01T00:35:32.962Z"}, "references": [{"name": ".NET Denial of Service Vulnerability", "tags": ["vendor-advisory"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21538"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "baseSeverity": "HIGH", "baseScore": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C"}}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-07-16T22:02:43.243536Z", "id": "CVE-2023-21538", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-16T22:02:48.609Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T09:44:01.057Z"}, "title": "CVE Program Container", "references": [{"name": ".NET Denial of Service Vulnerability", "tags": ["vendor-advisory", "x_transferred"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21538"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21538", "name": ".NET Denial of Service Vulnerability", "tags": ["vendor-advisory", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T09:44:01.057Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-21538", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-07-16T22:02:43.243536Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-16T22:02:46.459Z"}}], "cna": {"title": ".NET Denial of Service Vulnerability", "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C"}, "scenarios": [{"lang": "en-US", "value": "GENERAL"}]}], "affected": [{"vendor": "Microsoft", "product": ".NET 6.0", "versions": [{"status": "affected", "version": "6.0.0", "lessThan": "6.0.13", "versionType": "custom"}], "platforms": ["Unknown"]}, {"vendor": "Microsoft", "product": "PowerShell 7.2", "versions": [{"status": "affected", "version": "7.2.0", "lessThan": "7.2.9", "versionType": "custom"}], "platforms": ["Unknown"]}], "datePublic": "2023-01-10T08:00:00+00:00", "references": [{"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21538", "name": ".NET Denial of Service Vulnerability", "tags": ["vendor-advisory"]}], "descriptions": [{"lang": "en-US", "value": ".NET Denial of Service Vulnerability"}], "problemTypes": [{"descriptions": [{"lang": "en-US", "type": "CWE", "cweId": "CWE-502", "description": "CWE-502: Deserialization of Untrusted Data"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.0.13", "versionStartIncluding": "6.0.0"}, {"criteria": "cpe:2.3:a:microsoft:powershell:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.2.9", "versionStartIncluding": "7.2.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2025-01-01T00:35:32.962Z"}}}, "cveMetadata": {"cveId": "CVE-2023-21538", "state": "PUBLISHED", "dateUpdated": "2025-01-01T00:35:32.962Z", "dateReserved": "2022-12-01T00:00:00", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "datePublished": "2023-01-10T00:00:00", "assignerShortName": "microsoft"}, "dataVersion": "5.1"}