{"id":"CVE-2023-36558","state":"PUBLISHED","title":"ASP.NET Core Security Feature Bypass Vulnerability","description":"ASP.NET Core Security Feature Bypass Vulnerability","publishedAt":"2023-11-14T21:35:31.499Z","updatedAt":"2025-10-09T00:00:12.174Z","severity":{"score":6.2,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C","source":"microsoft"},"assigner":"microsoft","products":["Microsoft .NET 6.0","Microsoft ASP.NET Core 6.0","Microsoft .NET 7.0","Microsoft Microsoft Visual Studio 2022 version 17.2","Microsoft .NET 8.0","Microsoft Microsoft Visual Studio 2022 version 17.4","Microsoft Microsoft Visual Studio 2022 version 17.6","Microsoft Microsoft Visual Studio 2022 version 17.7","Microsoft ASP.NET Core 7.0","Microsoft ASP.NET Core 8.0"],"affected":[{"vendor":"Microsoft","product":".NET 6.0","versions":[{"version":"6.0.0","status":"affected","lessThan":"6.0.25","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"ASP.NET Core 6.0","versions":[{"version":"6.0","status":"affected","lessThan":"6.0.25","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":".NET 7.0","versions":[{"version":"7.0.0","status":"affected","lessThan":"7.0.14","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"Microsoft Visual Studio 2022 version 17.2","versions":[{"version":"17.2.0","status":"affected","lessThan":"17.2.22","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":".NET 8.0","versions":[{"version":"8.0","status":"affected","lessThan":"8.0.0","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"Microsoft Visual Studio 2022 version 17.4","versions":[{"version":"17.4.0","status":"affected","lessThan":"17.4.14","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"Microsoft Visual Studio 2022 version 17.6","versions":[{"version":"17.6.0","status":"affected","lessThan":"17.6.10","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"Microsoft Visual Studio 2022 version 17.7","versions":[{"version":"17.7.0","status":"affected","lessThan":"17.7.7","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"ASP.NET Core 7.0","versions":[{"version":"7.0.0","status":"affected","lessThan":"7.0.14","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"ASP.NET Core 8.0","versions":[{"version":"8.0","status":"affected","lessThan":"8.0.0","versionType":"custom"}],"platforms":["Unknown"]}],"references":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36558"],"weaknesses":[],"ingestedAt":"2026-10-29T20:06:08.715Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/36xxx/CVE-2023-36558.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2023-36558","state":"PUBLISHED","datePublished":"2023-11-14T21:35:31.499Z","dateUpdated":"2025-10-09T00:00:12.174Z","assignerShortName":"microsoft","assignerOrgId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","dateReserved":"2023-06-23T20:11:38.789Z"},"containers":{"cna":{"title":"ASP.NET Core Security Feature Bypass Vulnerability","descriptions":[{"lang":"en-US","value":"ASP.NET Core Security Feature Bypass Vulnerability"}],"affected":[{"vendor":"Microsoft","product":".NET 6.0","versions":[{"version":"6.0.0","status":"affected","lessThan":"6.0.25","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"ASP.NET Core 6.0","versions":[{"version":"6.0","status":"affected","lessThan":"6.0.25","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":".NET 7.0","versions":[{"version":"7.0.0","status":"affected","lessThan":"7.0.14","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"Microsoft Visual Studio 2022 version 17.2","versions":[{"version":"17.2.0","status":"affected","lessThan":"17.2.22","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":".NET 8.0","versions":[{"version":"8.0","status":"affected","lessThan":"8.0.0","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"Microsoft Visual Studio 2022 version 17.4","versions":[{"version":"17.4.0","status":"affected","lessThan":"17.4.14","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"Microsoft Visual Studio 2022 version 17.6","versions":[{"version":"17.6.0","status":"affected","lessThan":"17.6.10","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"Microsoft Visual Studio 2022 version 17.7","versions":[{"version":"17.7.0","status":"affected","lessThan":"17.7.7","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"ASP.NET Core 7.0","versions":[{"version":"7.0.0","status":"affected","lessThan":"7.0.14","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"ASP.NET Core 8.0","versions":[{"version":"8.0","status":"affected","lessThan":"8.0.0","versionType":"custom"}],"platforms":["Unknown"]}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36558","name":"ASP.NET Core Security Feature Bypass Vulnerability","tags":["vendor-advisory"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en-US","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","baseSeverity":"MEDIUM","baseScore":6.2,"vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C"}}],"problemTypes":[{"descriptions":[{"description":"Security Feature Bypass","lang":"en-US","type":"Impact"}]}],"providerMetadata":{"shortName":"microsoft","orgId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","dateUpdated":"2025-10-09T00:00:12.174Z"},"datePublic":"2023-11-14T08:00:00.000Z","cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0.0","versionEndExcluding":"6.0.25"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:asp.net_core:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0","versionEndExcluding":"6.0.25"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*","versionStartIncluding":"7.0.0","versionEndExcluding":"7.0.14"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*","versionStartIncluding":"17.2.0","versionEndExcluding":"17.2.22"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*","versionStartIncluding":"8.0","versionEndExcluding":"8.0.0"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*","versionStartIncluding":"17.4.0","versionEndExcluding":"17.4.14"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:visual_studio:*:*:*:*:*:*:*:*","versionStartIncluding":"17.6.0","versionEndExcluding":"17.6.10"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:visual_studio:*:*:*:*:*:*:*:*","versionStartIncluding":"17.7.0","versionEndExcluding":"17.7.7"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:asp.net_core:*:*:*:*:*:*:*:*","versionStartIncluding":"7.0.0","versionEndExcluding":"7.0.14"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:asp.net_core:*:*:*:*:*:*:*:*","versionStartIncluding":"8.0","versionEndExcluding":"8.0.0"}]}]}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-06-28T14:17:29.323763Z","id":"CVE-2023-36558","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-06-28T14:17:40.113Z"}},{"title":"CVE Program Container","references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36558","name":"ASP.NET Core - Security Feature Bypass Vulnerability","tags":["vendor-advisory","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T16:52:52.402Z"}}]}}}