{"id":"CVE-2023-28260","state":"PUBLISHED","title":".NET DLL Hijacking Remote Code Execution Vulnerability","description":".NET DLL Hijacking Remote Code Execution Vulnerability","publishedAt":"2023-04-11T19:13:56.662Z","updatedAt":"2026-05-28T18:13:55.892Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C","source":"microsoft"},"assigner":"microsoft","products":["Microsoft .NET 6.0","Microsoft .NET 7.0","Microsoft Microsoft Visual Studio 2022 version 17.5","Microsoft Microsoft Visual Studio 2022 version 17.4","Microsoft Microsoft Visual Studio 2022 version 17.2","Microsoft Microsoft Visual Studio 2022 version 17.0","Microsoft PowerShell 7.3","Microsoft PowerShell 7.2"],"affected":[{"vendor":"Microsoft","product":".NET 6.0","versions":[{"version":"6.0.0","status":"affected","lessThan":"6.0.16","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":".NET 7.0","versions":[{"version":"7.0.0","status":"affected","lessThan":"7.0.5","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"Microsoft Visual Studio 2022 version 17.5","versions":[{"version":"17.5.0","status":"affected","lessThan":"17.5.4","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"Microsoft Visual Studio 2022 version 17.4","versions":[{"version":"17.4.0","status":"affected","lessThan":"17.4.7","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"Microsoft Visual Studio 2022 version 17.2","versions":[{"version":"17.2.0","status":"affected","lessThan":"17.2.15","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"Microsoft Visual Studio 2022 version 17.0","versions":[{"version":"17.0.0","status":"affected","lessThan":"17.0.21","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"PowerShell 7.3","versions":[{"version":"7.3.0","status":"affected","lessThan":"7.3.4","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"PowerShell 7.2","versions":[{"version":"7.2.0","status":"affected","lessThan":"7.2.11","versionType":"custom"}],"platforms":["Unknown"]}],"references":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28260"],"weaknesses":[],"ingestedAt":"2026-10-29T20:05:52.290Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/28xxx/CVE-2023-28260.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2023-28260","state":"PUBLISHED","datePublished":"2023-04-11T19:13:56.662Z","dateUpdated":"2026-05-28T18:13:55.892Z","assignerShortName":"microsoft","assignerOrgId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","dateReserved":"2023-03-13T22:18:32.391Z"},"containers":{"cna":{"title":".NET DLL Hijacking Remote Code Execution Vulnerability","descriptions":[{"lang":"en-US","value":".NET DLL Hijacking Remote Code Execution Vulnerability"}],"affected":[{"vendor":"Microsoft","product":".NET 6.0","versions":[{"version":"6.0.0","status":"affected","lessThan":"6.0.16","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":".NET 7.0","versions":[{"version":"7.0.0","status":"affected","lessThan":"7.0.5","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"Microsoft Visual Studio 2022 version 17.5","versions":[{"version":"17.5.0","status":"affected","lessThan":"17.5.4","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"Microsoft Visual Studio 2022 version 17.4","versions":[{"version":"17.4.0","status":"affected","lessThan":"17.4.7","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"Microsoft Visual Studio 2022 version 17.2","versions":[{"version":"17.2.0","status":"affected","lessThan":"17.2.15","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"Microsoft Visual Studio 2022 version 17.0","versions":[{"version":"17.0.0","status":"affected","lessThan":"17.0.21","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"PowerShell 7.3","versions":[{"version":"7.3.0","status":"affected","lessThan":"7.3.4","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"PowerShell 7.2","versions":[{"version":"7.2.0","status":"affected","lessThan":"7.2.11","versionType":"custom"}],"platforms":["Unknown"]}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28260","name":".NET DLL Hijacking Remote Code Execution Vulnerability","tags":["vendor-advisory"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en-US","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","baseSeverity":"HIGH","baseScore":7.8,"vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C"}}],"problemTypes":[{"descriptions":[{"description":"Remote Code Execution","lang":"en-US","type":"Impact"}]}],"providerMetadata":{"shortName":"microsoft","orgId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","dateUpdated":"2025-01-23T01:05:17.536Z"},"datePublic":"2023-04-11T07:00:00.000Z","cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0.0","versionEndExcluding":"6.0.16"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*","versionStartIncluding":"7.0.0","versionEndExcluding":"7.0.5"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:visual_studio:*:*:*:*:*:*:*:*","versionStartIncluding":"17.5.0","versionEndExcluding":"17.5.4"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*","versionStartIncluding":"17.4.0","versionEndExcluding":"17.4.7"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*","versionStartIncluding":"17.2.0","versionEndExcluding":"17.2.15"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*","versionStartIncluding":"17.0.0","versionEndExcluding":"17.0.21"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:powershell:*:-:*:*:*:*:*:*","versionStartIncluding":"7.3.0","versionEndExcluding":"7.3.4"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:powershell:*:*:*:*:*:*:*:*","versionStartIncluding":"7.2.0","versionEndExcluding":"7.2.11"}]}]}]},"adp":[{"title":"CVE Program Container","references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28260","name":".NET DLL Hijacking Remote Code Execution Vulnerability","tags":["vendor-advisory","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T12:30:24.683Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-06-03T18:19:25.437289Z","id":"CVE-2023-28260","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"type":"CWE","lang":"en","description":"CWE-noinfo Not enough information"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-05-28T18:13:55.892Z"}}]}}}