CVE-2024-30045 json
.NET and Visual Studio Remote Code Execution Vulnerability
published 2024-05-14 2 y ago modified 2026-09-08 2 mo ago also BIT-dotnet-2024-30045 , BIT-dotnet-sdk-2024-30045 , BIT-powershell-2024-30045 , EUVD-2024-1487 , GHSA-7fcr-8qw6-92fr
- cvss
- 6.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.2%
- EPSS 1.2% chance of exploitation in 30 days, percentile 69%
- public exploits
- 0
- none known
Summary
.NET and Visual Studio Remote Code Execution Vulnerability
Patch / fix
- nuget Microsoft.NETCore.App.Runtime.linux-arm 7.0.19, 8.0.5
- nuget Microsoft.NETCore.App.Runtime.linux-arm64 7.0.19, 8.0.5
- nuget Microsoft.NETCore.App.Runtime.linux-musl-arm 7.0.19, 8.0.5
- nuget Microsoft.NETCore.App.Runtime.linux-musl-arm64 7.0.19, 8.0.5
- nuget Microsoft.NETCore.App.Runtime.linux-musl-x64 7.0.19, 8.0.5
- nuget Microsoft.NETCore.App.Runtime.linux-x64 7.0.19, 8.0.5
- nuget Microsoft.NETCore.App.Runtime.osx-arm64 7.0.19, 8.0.5
- nuget Microsoft.NETCore.App.Runtime.osx-x64 7.0.19, 8.0.5
- nuget Microsoft.NETCore.App.Runtime.win-arm 7.0.19, 8.0.5
- nuget Microsoft.NETCore.App.Runtime.win-arm64 7.0.19, 8.0.5
- nuget Microsoft.NETCore.App.Runtime.win-x64 7.0.19, 8.0.5
- nuget Microsoft.NETCore.App.Runtime.win-x86 7.0.19, 8.0.5
- bitnami dotnet 7.0.19, 8.0.5
- bitnami dotnet-sdk 7.0.19, 8.0.5
- bitnami powershell 7.4.3
- Microsoft .NET 8.0 8.0.5
- Microsoft .NET 7.0 7.0.19
- Microsoft Microsoft Visual Studio 2022 version 17.9 17.9.7
- Microsoft Microsoft Visual Studio 2022 version 17.4 17.4.19
- Microsoft Microsoft Visual Studio 2022 version 17.6 17.6.15
- Microsoft Microsoft Visual Studio 2022 version 17.8 17.8.10
- Microsoft PowerShell 7.4 7.4.3
- dotnet7 Ubuntu 22.04 LTS 7.0.119-0ubuntu1~22.04.1
- dotnet8 Ubuntu 22.04 LTS 8.0.105-8.0.5-0ubuntu1~22.04.1
- dotnet8 Ubuntu 24.04 LTS 8.0.105-8.0.5-0ubuntu1~24.04.1
ubuntu advisories UBUNTU-CVE-2024-30045
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- dotnet7.0 RHEL 8 7.0.119-1.el8_10
- dotnet-sdk-7.0 RHEL 8 7.0.119-1.el8_10
- dotnet-hostfxr-7.0 RHEL 8 7.0.19-1.el8_10
- dotnet-runtime-7.0 RHEL 8 7.0.19-1.el8_10
- dotnet-templates-7.0 RHEL 8 7.0.119-1.el8_10
- aspnetcore-runtime-7.0 RHEL 8 7.0.19-1.el8_10
- dotnet-apphost-pack-7.0 RHEL 8 7.0.19-1.el8_10
- dotnet-targeting-pack-7.0 RHEL 8 7.0.19-1.el8_10
red hat advisories RHSA-2024:3340RHSA-2024:3345RHSA-2024:2843RHSA-2024:2842
- dotnet-sdk-7.0 AlmaLinux 8 7.0.119-1.el8_10
- dotnet-hostfxr-7.0 AlmaLinux 8 7.0.19-1.el8_10
- dotnet-runtime-7.0 AlmaLinux 8 7.0.19-1.el8_10
- dotnet-templates-7.0 AlmaLinux 8 7.0.119-1.el8_10
- aspnetcore-runtime-7.0 AlmaLinux 8 7.0.19-1.el8_10
- dotnet-apphost-pack-7.0 AlmaLinux 8 7.0.19-1.el8_10
- dotnet-targeting-pack-7.0 AlmaLinux 8 7.0.19-1.el8_10
- aspnetcore-targeting-pack-7.0 AlmaLinux 8 7.0.19-1.el8_10
almalinux advisories ALSA-2024:3340ALSA-2024:3345ALSA-2024:2843ALSA-2024:2842
- dotnet8.0 Rocky Linux 9 8.0.105-1.el9_4
- dotnet7.0 Rocky Linux 9 7.0.119-1.el9_4
- dotnet7.0 Rocky Linux 8 7.0.119-1.el8_10
- dotnet8.0 Rocky Linux 8 8.0.105-1.el8_10
rocky linux advisories RLSA-2024:2842RLSA-2024:2843RLSA-2024:3340RLSA-2024:3345
- dotnet7-runtime Alpine 3.19 7.0.19-r0
- dotnet8-runtime Alpine 3.24, Alpine 3.23, Alpine 3.22 +2 more 8.0.5-r0
alpine advisories ALPINE-CVE-2024-30045
Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2024-30045 updated cvss 6.3
dotnet: stack buffer overrun in Double Parse
-
Red Hat Enterprise Linux AppStream (v. 8) dotnet 8.0.105-1.el8_10, dotnet-host 8.0.5-1.el8_10, dotnet7.0 7.0.119-1.el8_10, dotnet8.0 8.0.105-1.el8_10, dotnet-sdk-7.0 7.0.119-1.el8_10, dotnet-sdk-8.0 8.0.105-1.el8_10, +18 morefixed: vendor fix RHSA-2024:3340
-
Red Hat Enterprise Linux AppStream (v. 9) dotnet-host 8.0.5-1.el9_4, dotnet7.0 7.0.119-1.el9_4, dotnet8.0 8.0.105-1.el9_4, dotnet-sdk-7.0 7.0.119-1.el9_4, dotnet-sdk-8.0 8.0.105-1.el9_4, dotnet-hostfxr-8.0 8.0.5-1.el9_4, +17 morefixed: vendor fix RHSA-2024:2843
-
Red Hat Enterprise Linux CRB (v. 8) dotnet-sdk-7.0-source-built-artifacts 7.0.119-1.el8_10, dotnet-sdk-8.0-source-built-artifacts 8.0.105-1.el8_10fixed: vendor fix RHSA-2024:3340
-
Red Hat Enterprise Linux CRB (v. 9) dotnet-sdk-7.0-source-built-artifacts 7.0.119-1.el9_4, dotnet-sdk-8.0-source-built-artifacts 8.0.105-1.el9_4fixed: vendor fix RHSA-2024:2843
-
Red Hat Enterprise Linux 10 dotnet8.0not affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
cisa ICSA-24-228-02 updated cvss 5.5
Siemens INTRALOG WMS
-
Siemens INTRALOG WMS <V4affected: vendor fix
Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
1.25% chance of exploitation in the next 30 days, higher than 69% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C |
| GitHub | 3.1 | 6.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L |
| CNA | 3.1 | 6.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L |
| OSV | 3.1 | 6.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| nuget | Microsoft.NETCore.App.Runtime.linux-arm | >=7.0.0, <7.0.19 >=8.0.0, <8.0.5 |
7.0.19 8.0.5 |
| nuget | Microsoft.NETCore.App.Runtime.linux-arm64 | >=7.0.0, <7.0.19 >=8.0.0, <8.0.5 |
7.0.19 8.0.5 |
| nuget | Microsoft.NETCore.App.Runtime.linux-musl-arm | >=7.0.0, <7.0.19 >=8.0.0, <8.0.5 |
7.0.19 8.0.5 |
| nuget | Microsoft.NETCore.App.Runtime.linux-musl-arm64 | >=8.0.0, <8.0.5 >=7.0.0, <7.0.19 |
8.0.5 7.0.19 |
| nuget | Microsoft.NETCore.App.Runtime.linux-musl-x64 | >=7.0.0, <7.0.19 >=8.0.0, <8.0.5 |
7.0.19 8.0.5 |
| nuget | Microsoft.NETCore.App.Runtime.linux-x64 | >=7.0.0, <7.0.19 >=8.0.0, <8.0.5 |
7.0.19 8.0.5 |
| nuget | Microsoft.NETCore.App.Runtime.osx-arm64 | >=7.0.0, <7.0.19 >=8.0.0, <8.0.5 |
7.0.19 8.0.5 |
| nuget | Microsoft.NETCore.App.Runtime.osx-x64 | >=7.0.0, <7.0.19 >=8.0.0, <8.0.5 |
7.0.19 8.0.5 |
| nuget | Microsoft.NETCore.App.Runtime.win-arm | >=7.0.0, <7.0.19 >=8.0.0, <8.0.5 |
7.0.19 8.0.5 |
| nuget | Microsoft.NETCore.App.Runtime.win-arm64 | >=7.0.0, <7.0.19 >=8.0.0, <8.0.5 |
7.0.19 8.0.5 |
| nuget | Microsoft.NETCore.App.Runtime.win-x64 | >=7.0.0, <7.0.19 >=8.0.0, <8.0.5 |
7.0.19 8.0.5 |
| nuget | Microsoft.NETCore.App.Runtime.win-x86 | >=7.0.0, <7.0.19 >=8.0.0, <8.0.5 |
7.0.19 8.0.5 |
| bitnami | dotnet | >=7.0.0, <7.0.19 >=8.0.0, <8.0.5 |
7.0.19 8.0.5 |
| bitnami | dotnet-sdk | >=7.0.0, <7.0.19 >=8.0.0, <8.0.5 |
7.0.19 8.0.5 |
| bitnami | powershell | >=7.4.0, <7.4.3 |
7.4.3 |
Affected products
- Microsoft .NET 8.0
- Microsoft .NET 7.0
- Microsoft Microsoft Visual Studio 2022 version 17.9
- Microsoft Microsoft Visual Studio 2022 version 17.4
- Microsoft Microsoft Visual Studio 2022 version 17.6
- Microsoft Microsoft Visual Studio 2022 version 17.8
- Microsoft PowerShell 7.4
Classification
- Weakness
-
- CWE-122 Heap-based Buffer Overflow
References
-
msrc.microsoft.com
/update-guide/vulnerability/CVE-2024-30045
vendor-advisory, web, advisory
-
security.netapp.com
/advisory/ntap-20241122-0001/
third-party-advisory, advisory
-
github.com
/dotnet/runtime/security/advisories/GHSA-7fcr-8qw6-92fr
web
-
nvd.nist.gov
/vuln/detail/CVE-2024-30045
advisory, web
-
github.com
/dotnet/announcements/issues/307
web
-
github.com
/dotnet/runtime/issues/102206
web
-
github.com
/dotnet/runtime
package
-
security.netapp.com
/advisory/ntap-20241122-0001
web
Sources
- CVE List CVE-2024-30045
- GitHub Advisory GHSA-7fcr-8qw6-92fr
- NVD CVE-2024-30045
- OSV BIT-dotnet-2024-30045
- OSV BIT-dotnet-sdk-2024-30045
- OSV BIT-powershell-2024-30045
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.