medium 6.2

CVE-2023-36558 json

ASP.NET Core Security Feature Bypass Vulnerability

published 2023-11-14 2 y ago modified 2026-09-08 2 mo ago also BIT-aspnet-core-2023-36558 , BIT-dotnet-2023-36558 , BIT-dotnet-sdk-2023-36558 , EUVD-2023-2860 , GHSA-3fx3-85r4-8j3w

cvss: 6.2; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 1.1%; EPSS 1.1% chance of exploitation in 30 days, percentile 65%
public exploits: 0; none known

Patch / fix

fixed in 14 distros 5 links 1

nuget Microsoft.AspNetCore.Components 6.0.25, 7.0.14, 8.0.0
bitnami aspnet-core 6.0.25, 7.0.14, 8.0.1
bitnami dotnet 6.0.25, 7.0.14
bitnami dotnet-sdk 6.0.25, 7.0.14
Microsoft .NET 6.0 6.0.25
Microsoft ASP.NET Core 6.0 6.0.25
Microsoft .NET 7.0 7.0.14
Microsoft Microsoft Visual Studio 2022 version 17.2 17.2.22
Microsoft .NET 8.0 8.0.0
Microsoft Microsoft Visual Studio 2022 version 17.4 17.4.14
Microsoft Microsoft Visual Studio 2022 version 17.6 17.6.10
Microsoft Microsoft Visual Studio 2022 version 17.7 17.7.7
Microsoft ASP.NET Core 7.0 7.0.14
Microsoft ASP.NET Core 8.0 8.0.0

ubuntu red hat almalinux rocky linux alpine

dotnet6 Ubuntu 22.04 LTS 6.0.125-0ubuntu1~22.04.1
dotnet7 Ubuntu 22.04 LTS 7.0.114-0ubuntu1~22.04.1

ubuntu advisories UBUNTU-CVE-2023-36558

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

dotnet8.0 RHEL 8 8.0.100-2.el8_9
dotnet RHEL 8 8.0.100-2.el8_9
dotnet-host RHEL 8 8.0.0-2.el8_9
dotnet-sdk-8.0 RHEL 8 8.0.100-2.el8_9
dotnet-hostfxr-8.0 RHEL 8 8.0.0-2.el8_9
dotnet-runtime-8.0 RHEL 8 8.0.0-2.el8_9
dotnet-templates-8.0 RHEL 8 8.0.100-2.el8_9
aspnetcore-runtime-8.0 RHEL 8 8.0.0-2.el8_9

red hat advisories RHSA-2023:7254 RHSA-2023:7255 RHSA-2023:7253 RHSA-2023:7256 RHSA-2023:7257 RHSA-2023:7259

dotnet-host AlmaLinux 9 8.0.0-2.el9_3
dotnet-sdk-8.0 AlmaLinux 9 8.0.100-2.el9_3
dotnet-hostfxr-8.0 AlmaLinux 9 8.0.0-2.el9_3
dotnet-runtime-8.0 AlmaLinux 9 8.0.0-2.el9_3
dotnet-templates-8.0 AlmaLinux 9 8.0.100-2.el9_3
aspnetcore-runtime-8.0 AlmaLinux 9 8.0.0-2.el9_3
dotnet-apphost-pack-8.0 AlmaLinux 9 8.0.0-2.el9_3
dotnet-targeting-pack-8.0 AlmaLinux 9 8.0.0-2.el9_3

almalinux advisories ALSA-2023:7253 ALSA-2023:7254 ALSA-2023:7255 ALSA-2023:7256 ALSA-2023:7257 ALSA-2023:7258

dotnet7.0 Rocky Linux 8 7.0.114-1.el8_9
dotnet6.0 Rocky Linux 8 6.0.125-1.el8_9

rocky linux advisories RLSA-2023:7256 RLSA-2023:7258

dotnet6-build Alpine 3.20, Alpine 3.19, Alpine 3.18 6.0.125-r0
dotnet7-build Alpine 3.19, Alpine 3.18 7.0.114-r0
dotnet6-runtime Alpine 3.20, Alpine 3.19, Alpine 3.18 6.0.25-r0
dotnet7-runtime Alpine 3.19, Alpine 3.18 7.0.14-r0

alpine advisories ALPINE-CVE-2023-36558

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36558 advisory

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-36558 updated 2025-11-21 cvss 5.5

dotnet: ASP.NET Security Feature Bypass Vulnerability in Blazor forms

Red Hat .NET Core on Red Hat Enterprise Linux ComputeNode (v. 7) rh-dotnet60-dotnet 6.0.125-1.el7_9, rh-dotnet60-dotnet-host 6.0.25-1.el7_9, rh-dotnet60-dotnet-sdk-6.0 6.0.125-1.el7_9, rh-dotnet60-dotnet-hostfxr-6.0 6.0.25-1.el7_9, rh-dotnet60-dotnet-runtime-6.0 6.0.25-1.el7_9, rh-dotnet60-dotnet-templates-6.0 6.0.125-1.el7_9, +6 more Red Hat .NET Core on Red Hat Enterprise Linux Server (v. 7) rh-dotnet60-dotnet 6.0.125-1.el7_9, rh-dotnet60-dotnet-host 6.0.25-1.el7_9, rh-dotnet60-dotnet-sdk-6.0 6.0.125-1.el7_9, rh-dotnet60-dotnet-hostfxr-6.0 6.0.25-1.el7_9, rh-dotnet60-dotnet-runtime-6.0 6.0.25-1.el7_9, rh-dotnet60-dotnet-templates-6.0 6.0.125-1.el7_9, +6 more Red Hat .NET Core on Red Hat Enterprise Linux Workstation (v. 7) rh-dotnet60-dotnet 6.0.125-1.el7_9, rh-dotnet60-dotnet-host 6.0.25-1.el7_9, rh-dotnet60-dotnet-sdk-6.0 6.0.125-1.el7_9, rh-dotnet60-dotnet-hostfxr-6.0 6.0.25-1.el7_9, rh-dotnet60-dotnet-runtime-6.0 6.0.25-1.el7_9, rh-dotnet60-dotnet-templates-6.0 6.0.125-1.el7_9, +6 more
fixed: vendor fix RHSA-2023:7259
Red Hat CodeReady Linux Builder (v. 8) dotnet 8.0.100-2.el8_9, dotnet-host 8.0.0-2.el8_9, dotnet6.0 6.0.125-1.el8_9, dotnet7.0 7.0.114-1.el8_9, dotnet8.0 8.0.100-2.el8_9, dotnet-sdk-6.0 6.0.125-1.el8_9, +27 more
fixed: vendor fix RHSA-2023:7258
Red Hat CodeReady Linux Builder (v. 9) dotnet-host 8.0.0-2.el9_3, dotnet6.0 6.0.125-1.el9_3, dotnet7.0 7.0.114-1.el9_3, dotnet8.0 8.0.100-2.el9_3, dotnet-sdk-6.0 6.0.125-1.el9_3, dotnet-sdk-7.0 7.0.114-1.el9_3, +26 more
fixed: vendor fix RHSA-2023:7257
Red Hat Enterprise Linux AppStream (v. 8) dotnet 8.0.100-2.el8_9, dotnet-host 8.0.0-2.el8_9, dotnet6.0 6.0.125-1.el8_9, dotnet7.0 7.0.114-1.el8_9, dotnet8.0 8.0.100-2.el8_9, dotnet-sdk-6.0 6.0.125-1.el8_9, +27 more
fixed: vendor fix RHSA-2023:7258
Red Hat Enterprise Linux AppStream (v. 9) dotnet-host 8.0.0-2.el9_3, dotnet6.0 6.0.125-1.el9_3, dotnet7.0 7.0.114-1.el9_3, dotnet8.0 8.0.100-2.el9_3, dotnet-sdk-6.0 6.0.125-1.el9_3, dotnet-sdk-7.0 7.0.114-1.el9_3, +26 more
fixed: vendor fix RHSA-2023:7257

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-24-165-04 updated 2024-06-11 cvss 6.2

Siemens ST7 ScadaConnect

Siemens ST7 ScadaConnect (6NH7997-5DA10-0AA0) <V1.1
affected: fixed in V1.1 support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: total
Assessed: 2 y ago (2024-06-28)

Exploit prediction

1.08% chance of exploitation in the next 30 days, higher than 65% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	6.2	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C
GitHub	3.1	6.2	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CNA	3.1	6.2	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD	3.1	5.5	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
OSV	3.1	5.5	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected packages

ecosystem	package	affected	fixed in
nuget	Microsoft.AspNetCore.Components	>=8.0.0-rc.2.23480.2, <8.0.0 >=7.0.0, <7.0.14 >=6.0.0, <6.0.25	8.0.0 7.0.14 6.0.25
bitnami	aspnet-core	>=6.0.0, <6.0.25 >=7.0.0, <7.0.14 >=8.0.0, <8.0.1	6.0.25 7.0.14 8.0.1
bitnami	dotnet	>=6.0.0, <6.0.25 >=7.0.0, <7.0.14	6.0.25 7.0.14
bitnami	dotnet-sdk	>=6.0.0, <6.0.25 >=7.0.0, <7.0.14	6.0.25 7.0.14

Affected products

Microsoft .NET 6.0
Microsoft ASP.NET Core 6.0
Microsoft .NET 7.0
Microsoft Microsoft Visual Studio 2022 version 17.2
Microsoft .NET 8.0
Microsoft Microsoft Visual Studio 2022 version 17.4
Microsoft Microsoft Visual Studio 2022 version 17.6
Microsoft Microsoft Visual Studio 2022 version 17.7
Microsoft ASP.NET Core 7.0
Microsoft ASP.NET Core 8.0

References

msrc.microsoft.com /update-guide/vulnerability/CVE-2023-36558
vendor-advisory, web, patch, advisory
github.com /dotnet/runtime/security/advisories/GHSA-3fx3-85r4-8j3w
web
nvd.nist.gov /vuln/detail/CVE-2023-36558
advisory, web
github.com /dotnet/announcements/issues/288
web
github.com /dotnet/runtime
package

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary