CVE-2024-30045HighCVSS 6.3

.NET and Visual Studio Remote Code Execution Vulnerability

Published
May 14, 2024
Last Modified
—

🔗 CVE IDs covered (1)

CVE-2024-30045 →

📋 Description

According to the CVSS metrics, successful exploitation of this vulnerability could lead to minor loss of confidentiality (C:L), integrity (I:L) and availability (A:L). What does that mean for this vulnerability? While we cannot rule out the impact to Confidentiality, Integrity, and Availability, the ability to exploit this vulnerability by itself is limited. An attacker would need to combine this with other vulnerabilities to perform an attack.

According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do? Exploitation of this vulnerability requires that a user trigger the payload in the application.

🎯 Affected products7

  • .NET 7.0
  • .NET 8.0
  • Microsoft Visual Studio 2022 version 17.4
  • Microsoft Visual Studio 2022 version 17.6
  • Microsoft Visual Studio 2022 version 17.8
  • Microsoft Visual Studio 2022 version 17.9
  • PowerShell 7.4

✅ Remediation

KB5038352 (Security Update) — fixed build 8.0.5 KB5038351 (Security Update) — fixed build 7.0.19 KBRelease Notes (Security Update) — fixed build 17.9.7 KBRelease Notes (Security Update) — fixed build 17.4.19 KBRelease Notes (Security Update) — fixed build 17.6.15 KBRelease Notes (Security Update) — fixed build 17.8.10 KBRelease Notes (Security Update) — fixed build 7.4.3

🔗 References (11)