{"id":"CVE-2025-24070","state":"PUBLISHED","title":"ASP.NET Core and Visual Studio Elevation of Privilege Vulnerability","description":"Weak authentication in ASP.NET Core & Visual Studio allows an unauthorized attacker to elevate privileges over a network.","publishedAt":"2025-03-11T16:58:54.453Z","updatedAt":"2026-02-13T19:38:35.760Z","severity":{"score":7,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H/E:U/RL:O/RC:C","source":"microsoft"},"assigner":"microsoft","products":["Microsoft ASP.NET Core 8.0","Microsoft ASP.NET Core 9.0","Microsoft Microsoft Visual Studio 2022 version 17.10","Microsoft Microsoft Visual Studio 2022 version 17.12","Microsoft Microsoft Visual Studio 2022 version 17.13","Microsoft Microsoft Visual Studio 2022 version 17.8"],"affected":[{"vendor":"Microsoft","product":"ASP.NET Core 8.0","versions":[{"version":"8.0","status":"affected","lessThan":"8.0.14","versionType":"custom"}]},{"vendor":"Microsoft","product":"ASP.NET Core 9.0","versions":[{"version":"9.0","status":"affected","lessThan":"9.0.3","versionType":"custom"}]},{"vendor":"Microsoft","product":"Microsoft Visual Studio 2022 version 17.10","versions":[{"version":"17.10.0","status":"affected","lessThan":"17.10.12","versionType":"custom"}]},{"vendor":"Microsoft","product":"Microsoft Visual Studio 2022 version 17.12","versions":[{"version":"17.12.0","status":"affected","lessThan":"17.12.6","versionType":"custom"}]},{"vendor":"Microsoft","product":"Microsoft Visual Studio 2022 version 17.13","versions":[{"version":"17.13.0","status":"affected","lessThan":"17.13.3","versionType":"custom"}]},{"vendor":"Microsoft","product":"Microsoft Visual Studio 2022 version 17.8","versions":[{"version":"17.8.0","status":"affected","lessThan":"17.8.19","versionType":"custom"}]}],"references":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24070","https://www.herodevs.com/vulnerability-directory/cve-2025-24070"],"weaknesses":["CWE-1390"],"ingestedAt":"2026-10-29T20:08:47.682Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/24xxx/CVE-2025-24070.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-24070","state":"PUBLISHED","datePublished":"2025-03-11T16:58:54.453Z","dateUpdated":"2026-02-13T19:38:35.760Z","assignerShortName":"microsoft","assignerOrgId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","dateReserved":"2025-01-16T23:11:19.734Z"},"containers":{"cna":{"title":"ASP.NET Core and Visual Studio Elevation of Privilege Vulnerability","descriptions":[{"lang":"en-US","value":"Weak authentication in ASP.NET Core & Visual Studio allows an unauthorized attacker to elevate privileges over a network."}],"affected":[{"vendor":"Microsoft","product":"ASP.NET Core 8.0","versions":[{"version":"8.0","status":"affected","lessThan":"8.0.14","versionType":"custom"}]},{"vendor":"Microsoft","product":"ASP.NET Core 9.0","versions":[{"version":"9.0","status":"affected","lessThan":"9.0.3","versionType":"custom"}]},{"vendor":"Microsoft","product":"Microsoft Visual Studio 2022 version 17.10","versions":[{"version":"17.10.0","status":"affected","lessThan":"17.10.12","versionType":"custom"}]},{"vendor":"Microsoft","product":"Microsoft Visual Studio 2022 version 17.12","versions":[{"version":"17.12.0","status":"affected","lessThan":"17.12.6","versionType":"custom"}]},{"vendor":"Microsoft","product":"Microsoft Visual Studio 2022 version 17.13","versions":[{"version":"17.13.0","status":"affected","lessThan":"17.13.3","versionType":"custom"}]},{"vendor":"Microsoft","product":"Microsoft Visual Studio 2022 version 17.8","versions":[{"version":"17.8.0","status":"affected","lessThan":"17.8.19","versionType":"custom"}]}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24070","name":"ASP.NET Core and Visual Studio Elevation of Privilege Vulnerability","tags":["vendor-advisory","patch"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en-US","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","baseSeverity":"HIGH","baseScore":7,"vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H/E:U/RL:O/RC:C"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-1390","description":"CWE-1390: Weak Authentication","lang":"en-US","type":"CWE"}]}],"providerMetadata":{"shortName":"microsoft","orgId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","dateUpdated":"2026-02-13T19:38:35.760Z"},"datePublic":"2025-03-11T07:00:00.000Z","cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:asp.net_core:*:*:*:*:*:*:*:*","versionStartIncluding":"8.0","versionEndExcluding":"8.0.14"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:asp.net_core:*:*:*:*:*:*:*:*","versionStartIncluding":"9.0","versionEndExcluding":"9.0.3"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*","versionStartIncluding":"17.12.0","versionEndExcluding":"17.12.6"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*","versionStartIncluding":"17.13.0","versionEndExcluding":"17.13.3"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*","versionStartIncluding":"17.8.0","versionEndExcluding":"17.8.19"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*","versionStartIncluding":"17.10.0","versionEndExcluding":"17.10.12"}]}]}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-03-11T18:23:50.888858Z","id":"CVE-2025-24070","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-03-11T18:34:59.091Z"}},{"title":"CVE Program Container","references":[{"url":"https://www.herodevs.com/vulnerability-directory/cve-2025-24070"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2025-05-06T14:22:21.383Z"},"x_generator":{"engine":"ADPogram 0.0.1"}}]}}}