{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-33170", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "state": "PUBLISHED", "assignerShortName": "microsoft", "dateReserved": "2023-05-17T21:16:44.903Z", "datePublished": "2023-07-11T17:03:13.113Z", "dateUpdated": "2025-01-01T01:52:48.640Z"}, "containers": {"cna": {"title": "ASP.NET and Visual Studio Security Feature Bypass Vulnerability", "datePublic": "2023-07-11T07:00:00+00:00", "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*", "versionStartIncluding": "17.2.0", "versionEndExcluding": "17.2.17"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*", "versionStartIncluding": "17.0.0", "versionEndExcluding": "17.0.23"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*", "versionStartIncluding": "17.4.0", "versionEndExcluding": "17.4.9"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:visual_studio:*:*:*:*:*:*:*:*", "versionStartIncluding": "17.6.0", "versionEndExcluding": "17.6.5"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0.0", "versionEndExcluding": "6.0.20"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0.0", "versionEndExcluding": "7.0.9"}]}]}], "affected": [{"vendor": "Microsoft", "product": "Microsoft Visual Studio 2022 version 17.2", "platforms": ["Unknown"], "versions": [{"version": "17.2.0", "lessThan": "17.2.17", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Visual Studio 2022 version 17.0", "platforms": ["Unknown"], "versions": [{"version": "17.0.0", "lessThan": "17.0.23", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Visual Studio 2022 version 17.4", "platforms": ["Unknown"], "versions": [{"version": "17.4.0", "lessThan": "17.4.9", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Visual Studio 2022 version 17.6", "platforms": ["Unknown"], "versions": [{"version": "17.6.0", "lessThan": "17.6.5", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": ".NET 6.0", "platforms": ["Unknown"], "versions": [{"version": "6.0.0", "lessThan": "6.0.20", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": ".NET 7.0", "platforms": ["Unknown"], "versions": [{"version": "7.0.0", "lessThan": "7.0.9", "versionType": "custom", "status": "affected"}]}], "descriptions": [{"value": "ASP.NET and Visual Studio Security Feature Bypass Vulnerability", "lang": "en-US"}], "problemTypes": [{"descriptions": [{"description": "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')", "lang": "en-US", "type": "CWE", "cweId": "CWE-362"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2025-01-01T01:52:48.640Z"}, "references": [{"name": "ASP.NET and Visual Studio Security Feature Bypass Vulnerability", "tags": ["vendor-advisory"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-33170"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "baseSeverity": "HIGH", "baseScore": 8.1, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C"}}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T15:39:35.661Z"}, "title": "CVE Program Container", "references": [{"name": "ASP.NET and Visual Studio Security Feature Bypass Vulnerability", "tags": ["vendor-advisory", "x_transferred"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-33170"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EVZVMMCCBBCSCPAW2CRQGOTKIHVFCMRO/", "tags": ["x_transferred"]}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TLWNIIA2I6YCYVCXYBPBRSZ3UH6KILTG/", "tags": ["x_transferred"]}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Y3VJRGNYJXGPF5LXUG3NL45QPK2UU6PL/", "tags": ["x_transferred"]}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O5CFOR6ID2HP45E7ZOGQNX76FPIWP7XR/", "tags": ["x_transferred"]}]}]}}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*", "matchCriteriaId": "5730CE86-D1BB-403D-BE28-09BAC686B645", "versionEndExcluding": "6.0.20", "versionStartIncluding": "6.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*", "matchCriteriaId": "4EBEC922-21D4-458E-B9A9-A29CAD09C2D3", "versionEndExcluding": "7.0.9", "versionStartIncluding": "7.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*", "matchCriteriaId": "46E1B01E-2B9A-4666-A680-DED9669FD62B", "versionEndExcluding": "17.0.23", "versionStartIncluding": "17.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*", "matchCriteriaId": "63B52F8F-CF6B-40C5-B4D9-342FA4C3D21C", "versionEndExcluding": "17.2.17", "versionStartIncluding": "17.2.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*", "matchCriteriaId": "45D57A7D-14A4-4916-B029-12E8D3C8EDAD", "versionEndExcluding": "17.4.9", "versionStartIncluding": "17.4.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*", "matchCriteriaId": "D8771AEC-CE62-4C47-922A-A6205FDF3ECE", "versionEndExcluding": "17.6.5", "versionStartIncluding": "17.6.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*", "matchCriteriaId": "E30D0E6F-4AE8-4284-8716-991DFA48CC5D", "vulnerable": true}, {"criteria": "cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*", "matchCriteriaId": "CC559B26-5DFC-4B7A-A27C-B77DE755DFF9", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "ASP.NET and Visual Studio Security Feature Bypass Vulnerability"}], "id": "CVE-2023-33170", "lastModified": "2025-01-01T02:15:49.803", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "secure@microsoft.com", "type": "Secondary"}]}, "published": "2023-07-11T18:15:15.660", "references": [{"source": "secure@microsoft.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-33170"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List"], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EVZVMMCCBBCSCPAW2CRQGOTKIHVFCMRO/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List"], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O5CFOR6ID2HP45E7ZOGQNX76FPIWP7XR/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List"], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TLWNIIA2I6YCYVCXYBPBRSZ3UH6KILTG/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List"], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Y3VJRGNYJXGPF5LXUG3NL45QPK2UU6PL/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-33170"}], "sourceIdentifier": "secure@microsoft.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-362"}], "source": "secure@microsoft.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-362"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2023:4061", "cpe": "cpe:/a:redhat:rhel_dotnet:6.0::el7", "package": "rh-dotnet60-dotnet-0:6.0.120-1.el7_9", "product_name": ".NET Core on Red Hat Enterprise Linux", "release_date": "2023-07-13T00:00:00Z"}, {"advisory": "RHSA-2023:4058", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "dotnet7.0-0:7.0.109-1.el8_8", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2023-07-13T00:00:00Z"}, {"advisory": "RHSA-2023:4059", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "dotnet6.0-0:6.0.120-1.el8_8", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2023-07-13T00:00:00Z"}, {"advisory": "RHSA-2023:4448", "cpe": "cpe:/a:redhat:rhel_eus:8.6", "package": "dotnet6.0-0:6.0.120-1.el8_6", "product_name": "Red Hat Enterprise Linux 8.6 Extended Update Support", "release_date": "2023-08-03T00:00:00Z"}, {"advisory": "RHSA-2023:4057", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "dotnet7.0-0:7.0.109-1.el9_2", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2023-07-13T00:00:00Z"}, {"advisory": "RHSA-2023:4060", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "dotnet6.0-0:6.0.120-1.el9_2", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2023-07-13T00:00:00Z"}, {"advisory": "RHSA-2023:4449", "cpe": "cpe:/a:redhat:rhel_eus:9.0", "package": "dotnet6.0-0:6.0.120-1.el9_0", "product_name": "Red Hat Enterprise Linux 9.0 Extended Update Support", "release_date": "2023-08-03T00:00:00Z"}], "bugzilla": {"description": "dotnet: race condition in Core SignInManager<TUser> PasswordSignInAsync method", "id": "2221854", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2221854"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "status": "verified"}, "cwe": "CWE-362", "details": ["ASP.NET and Visual Studio Security Feature Bypass Vulnerability", "A vulnerability was found in dotNET applications where account lockout maximum failed attempts may not be immediately updated, allowing an attacker to try more passwords and bypass security restrictions. This flaw allows a remote attacker to bypass security features, causing an impact on confidentiality, integrity, and availability."], "name": "CVE-2023-33170", "public_date": "2023-07-11T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2023-33170\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-33170\nhttps://devblogs.microsoft.com/dotnet/july-2023-updates/\nhttps://github.com/advisories/GHSA-25c8-p796-jg6r\nhttps://github.com/dotnet/announcements/issues/264\nhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-33170"], "threat_severity": "Important", "upstream_fix": "dotnet 6.0.20, dotnet 7.0.9"}