{
  "document": {
    "acknowledgments": [
      {
        "names": [
          "Tom Deseyn of \u003ca href=\"https://www.redhat.com/\"\u003eRed Hat\u003c/a\u003e"
        ]
      }
    ],
    "aggregate_severity": {
      "namespace": "https://www.microsoft.com/en-us/msrc/security-update-severity-rating-system",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Public",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The information provided in the Microsoft Knowledge Base is provided \\\"as is\\\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.",
        "title": "Disclaimer"
      },
      {
        "category": "general",
        "text": "Required. The vulnerability documented by this CVE requires customer action to resolve.",
        "title": "Customer Action"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "secure@microsoft.com",
      "name": "Microsoft Security Response Center",
      "namespace": "https://msrc.microsoft.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "CVE-2023-32032 .NET and Visual Studio Elevation of Privilege Vulnerability - HTML",
        "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-32032"
      },
      {
        "category": "self",
        "summary": "CVE-2023-32032 .NET and Visual Studio Elevation of Privilege Vulnerability - CSAF",
        "url": "https://msrc.microsoft.com/csaf/2023/msrc_cve-2023-32032.json"
      },
      {
        "category": "external",
        "summary": "Microsoft Exploitability Index",
        "url": "https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1"
      },
      {
        "category": "external",
        "summary": "Microsoft Support Lifecycle",
        "url": "https://support.microsoft.com/lifecycle"
      },
      {
        "category": "external",
        "summary": "Common Vulnerability Scoring System",
        "url": "https://www.first.org/cvss"
      }
    ],
    "title": ".NET and Visual Studio Elevation of Privilege Vulnerability",
    "tracking": {
      "current_release_date": "2023-06-29T07:00:00.000Z",
      "generator": {
        "date": "2025-01-01T01:43:29.902Z",
        "engine": {
          "name": "MSRC Generator",
          "version": "1.0"
        }
      },
      "id": "msrc_CVE-2023-32032",
      "initial_release_date": "2023-06-13T07:00:00.000Z",
      "revision_history": [
        {
          "date": "2023-06-13T07:00:00.000Z",
          "legacy_version": "1",
          "number": "1",
          "summary": "Information published."
        },
        {
          "date": "2023-06-29T07:00:00.000Z",
          "legacy_version": "2",
          "number": "2",
          "summary": "Revised the Security Updates table to include PowerShell 7.3 because this version of PowerShell 7 is affected by this vulnerability. See [https://github.com/PowerShell/Announcements/issues/45](https://github.com/PowerShell/Announcements/issues/45) for more information."
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003c7.0.7",
            "product": {
              "name": ".NET 7.0 \u003c7.0.7",
              "product_id": "3"
            }
          },
          {
            "category": "product_version",
            "name": "7.0.7",
            "product": {
              "name": ".NET 7.0 7.0.7",
              "product_id": "12130"
            }
          }
        ],
        "category": "product_name",
        "name": ".NET 7.0"
      },
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003c17.2.16",
            "product": {
              "name": "Microsoft Visual Studio 2022 version 17.2 \u003c17.2.16",
              "product_id": "5"
            }
          },
          {
            "category": "product_version",
            "name": "17.2.16",
            "product": {
              "name": "Microsoft Visual Studio 2022 version 17.2 17.2.16",
              "product_id": "12051"
            }
          }
        ],
        "category": "product_name",
        "name": "Microsoft Visual Studio 2022 version 17.2"
      },
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003c17.0.22",
            "product": {
              "name": "Microsoft Visual Studio 2022 version 17.0 \u003c17.0.22",
              "product_id": "6"
            }
          },
          {
            "category": "product_version",
            "name": "17.0.22",
            "product": {
              "name": "Microsoft Visual Studio 2022 version 17.0 17.0.22",
              "product_id": "11969"
            }
          }
        ],
        "category": "product_name",
        "name": "Microsoft Visual Studio 2022 version 17.0"
      },
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003c17.4.8",
            "product": {
              "name": "Microsoft Visual Studio 2022 version 17.4 \u003c17.4.8",
              "product_id": "4"
            }
          },
          {
            "category": "product_version",
            "name": "17.4.8",
            "product": {
              "name": "Microsoft Visual Studio 2022 version 17.4 17.4.8",
              "product_id": "12129"
            }
          }
        ],
        "category": "product_name",
        "name": "Microsoft Visual Studio 2022 version 17.4"
      },
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003c17.6.3",
            "product": {
              "name": "Microsoft Visual Studio 2022 version 17.6 \u003c17.6.3",
              "product_id": "1"
            }
          },
          {
            "category": "product_version",
            "name": "17.6.3",
            "product": {
              "name": "Microsoft Visual Studio 2022 version 17.6 17.6.3",
              "product_id": "12187"
            }
          }
        ],
        "category": "product_name",
        "name": "Microsoft Visual Studio 2022 version 17.6"
      },
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003c7.3.5",
            "product": {
              "name": "PowerShell 7.3 \u003c7.3.5",
              "product_id": "2"
            }
          },
          {
            "category": "product_version",
            "name": "7.3.5",
            "product": {
              "name": "PowerShell 7.3 7.3.5",
              "product_id": "12131"
            }
          }
        ],
        "category": "product_name",
        "name": "PowerShell 7.3"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-32032",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "general",
          "text": "Microsoft",
          "title": "Assigning CNA"
        },
        {
          "category": "faq",
          "text": "Successful exploitation of this vulnerability requires an attacker to invest time in repeated exploitation attempts through sending constant or intermittent data.",
          "title": "According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?"
        },
        {
          "category": "faq",
          "text": "An attacker who successfully exploited this vulnerability could overwrite arbitrary file content in the security context of the local system.",
          "title": "What privileges could be gained by an attacker who successfully exploited this vulnerability?"
        },
        {
          "category": "faq",
          "text": "An attacker must have access to the targeted worker role and the ability to deploy a malicious application within the worker. The attack itself is carried out locally on the worker role where a malicious application has been deployed.",
          "title": "According to the CVSS metrics, the attack vector is local (AV:L) and privilege required is low (PR:L). What does that mean for this vulnerability?"
        },
        {
          "category": "faq",
          "text": "An attacker who successfully exploited this vulnerability might be able to gain some understanding of the filesystem layout, but nothing confidential. The attacker would be able to write files, and thus impact Integrity of files if they were overwritten, and similarly cause a Denial of Service if required files, configurations, or both were overwritten.",
          "title": "According to the CVSS metric, successful exploitation of this vulnerability could lead to some loss of confidentiality (C:L)? What does that mean for this vulnerability?"
        }
      ],
      "product_status": {
        "fixed": [
          "11969",
          "12051",
          "12129",
          "12130",
          "12131",
          "12187"
        ],
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2023-32032 .NET and Visual Studio Elevation of Privilege Vulnerability - HTML",
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-32032"
        },
        {
          "category": "self",
          "summary": "CVE-2023-32032 .NET and Visual Studio Elevation of Privilege Vulnerability - CSAF",
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-32032"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-06-13T07:00:00.000Z",
          "details": "7.0.7:Security Update:https://support.microsoft.com/help/5027798",
          "product_ids": [
            "3"
          ],
          "url": "https://support.microsoft.com/help/5027798"
        },
        {
          "category": "vendor_fix",
          "date": "2023-06-13T07:00:00.000Z",
          "details": "17.2.16:Security Update:https://docs.microsoft.com/en-us/visualstudio/releases/2022/release-notes",
          "product_ids": [
            "5"
          ],
          "url": "https://docs.microsoft.com/en-us/visualstudio/releases/2022/release-notes"
        },
        {
          "category": "vendor_fix",
          "date": "2023-06-13T07:00:00.000Z",
          "details": "17.0.22:Security Update:https://docs.microsoft.com/en-us/visualstudio/releases/2022/release-notes-v17.0",
          "product_ids": [
            "6"
          ],
          "url": "https://docs.microsoft.com/en-us/visualstudio/releases/2022/release-notes-v17.0"
        },
        {
          "category": "vendor_fix",
          "date": "2023-06-13T07:00:00.000Z",
          "details": "17.4.8:Security Update:https://learn.microsoft.com/en-us/visualstudio/releases/2022/release-notes",
          "product_ids": [
            "4"
          ],
          "url": "https://learn.microsoft.com/en-us/visualstudio/releases/2022/release-notes"
        },
        {
          "category": "vendor_fix",
          "date": "2023-06-13T07:00:00.000Z",
          "details": "17.6.3:Security Update:https://learn.microsoft.com/en-us/visualstudio/releases/2022/release-notes",
          "product_ids": [
            "1"
          ],
          "url": "https://learn.microsoft.com/en-us/visualstudio/releases/2022/release-notes"
        },
        {
          "category": "vendor_fix",
          "date": "2023-06-13T07:00:00.000Z",
          "details": "7.3.5:Security Update:https://github.com/PowerShell/Announcements/issues/45",
          "product_ids": [
            "2"
          ],
          "url": "https://github.com/PowerShell/Announcements/issues/45"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "environmentalsScore": 0.0,
            "exploitCodeMaturity": "PROOF_OF_CONCEPT",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "remediationLevel": "OFFICIAL_FIX",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 5.9,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Elevation of Privilege"
        },
        {
          "category": "exploit_status",
          "details": "Exploited:No;Latest Software Release:Exploitation Less Likely"
        }
      ],
      "title": ".NET and Visual Studio Elevation of Privilege Vulnerability"
    }
  ]
}