GitHub Advisoryadvisory · NuGet

GHSA-r4mw-gxf7-vxr9 Remote code execution in Microsoft.WindowsDesktop.App.Ref

HIGH Published 2022-05-24 Modified 2022-07-28 Official page ↗
Aliases
CVE-2020-0606
Ecosystem
NuGet
Packages
Microsoft.WindowsDesktop.App.Ref, Microsoft.WindowsDesktop.App.Runtime.win-x86, Microsoft.WindowsDesktop.App.Runtime.win-x64
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-20
Reviewed
2022-07-28

Affected packages

• NuGet Microsoft.WindowsDesktop.App.Ref: >= 3.0.1, < 3.0.2 → fixed in 3.0.2 • NuGet Microsoft.WindowsDesktop.App.Ref: >= 3.1.0, < 3.1.1 → fixed in 3.1.1 • NuGet Microsoft.WindowsDesktop.App.Runtime.win-x86: >= 3.0.0, < 3.0.2 → fixed in 3.0.2 • NuGet Microsoft.WindowsDesktop.App.Runtime.win-x86: >= 3.1.0, < 3.1.11 → fixed in 3.1.11 • NuGet Microsoft.WindowsDesktop.App.Runtime.win-x64: >= 3.0.0, < 3.0.2 → fixed in 3.0.2 • NuGet Microsoft.WindowsDesktop.App.Runtime.win-x64: >= 3.1.0, < 3.1.11 → fixed in 3.1.11

Description

A remote code execution vulnerability exists in .NET software when the software fails to check the source markup of a file.An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user, aka '.NET Framework Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0605.

Related

Alias · CVE (1)

  • CVE-2020-0606 A remote code execution vulnerability exists in .NET software when the software fails to check the source markup of a file.An attacker who… vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References