{"id":"CVE-2024-0057","published":"2024-01-09T17:56:59Z","modified":"2025-06-03T14:30:26Z","title":"NET, .NET Framework, and Visual Studio Security Feature Bypass Vulnerability","vendor":"Microsoft","product":".NET 8.0","tier":"tail","description":{"text":"NET, .NET Framework, and Visual Studio Security Feature Bypass Vulnerability","provenance":"source","from":"CVE.org"},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RL:O/RC:C","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.02778,"percentile":0.8632,"provenance":"source"},"cwes":[{"id":"CWE-20","name":"Improper Input Validation"}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-0057","tags":["vendor-advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20240208-0007/","tags":["x_transferred"]}],"priority":{"score":23.6,"factors":[{"name":"EPSS percentile","points":17.26},{"name":"CVSS severity","points":6.37}]},"vendorSlug":"microsoft","affectedVersions":[{"vendor":"Microsoft","product":".NET 8.0","versions":[">= 8.0, < 8.0.1"]},{"vendor":"Microsoft","product":".NET 7.0","versions":[">= 7.0.0, < 7.0.15"]},{"vendor":"Microsoft","product":".NET 6.0","versions":[">= 6.0.0, < 6.0.26"]},{"vendor":"Microsoft","product":"Microsoft Visual Studio 2022 version 17.2","versions":[">= 17.2.0, < 17.2.23"]},{"vendor":"Microsoft","product":"Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10)","versions":[">= 16.11.0, < 16.11.34"]},{"vendor":"Microsoft","product":"Microsoft Visual Studio 2022 version 17.4","versions":[">= 17.4.0, < 17.4.15"]},{"vendor":"Microsoft","product":"Microsoft Visual Studio 2022 version 17.6","versions":[">= 17.6.0, < 17.6.11"]},{"vendor":"Microsoft","product":"Microsoft Visual Studio 2022 version 17.8","versions":[">= 17.8.0, < 17.8.4"]},{"vendor":"Microsoft","product":"NuGet 5.11.0","versions":[">= 5.11.0, < 5.11.6.0"]},{"vendor":"Microsoft","product":"NuGet 17.4.0","versions":[">= 17.4.0, < 17.4.3.0"]}],"affected":[{"ecosystem":"NuGet","package":"NuGet.CommandLine","vulnerableRanges":[">=4.6.0, <5.11.6",">=6.0.0, <6.0.6",">=6.3.0, <6.3.4",">=6.4.0, <6.4.3",">=6.6.0, <6.6.2",">=6.7.0, <6.7.1",">=6.8.0, <6.8.1"],"patched":["5.11.6","6.0.6","6.3.4","6.4.3","6.6.2","6.7.1","6.8.1"],"from":["GHSA-68w7-72jg-6qpp"],"provenance":"source"},{"ecosystem":"NuGet","package":"NuGet.Packaging","vulnerableRanges":[">=4.6.0, <5.11.6",">=6.0.0, <6.0.6",">=6.3.0, <6.3.4",">=6.4.0, <6.4.3",">=6.6.0, <6.6.2",">=6.7.0, <6.7.1",">=6.8.0, <6.8.1"],"patched":["5.11.6","6.0.6","6.3.4","6.4.3","6.6.2","6.7.1","6.8.1"],"from":["GHSA-68w7-72jg-6qpp"],"provenance":"source"}],"euvd":{"id":"EUVD-2024-0534","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-class-microsoft-net-cwe-20","packageHistory":[{"cve":"CVE-2022-30184","published":"2022-06-15","fixed":"6.2.1","kev":false},{"cve":"CVE-2022-41032","published":"2022-10-11","fixed":"6.3.1","kev":false},{"cve":"CVE-2023-29337","published":"2023-06-14","fixed":"6.6.1","kev":false,"link":{"from":"CVE-2023-29337","to":"CVE-2024-0057","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"NuGet:NuGet.CommandLine","fromFixed":"5.11.5","toFixed":"5.11.6","daysApart":209},{"kind":"version-step","provenance":"source","package":"NuGet:NuGet.CommandLine","fromFixed":"6.0.5","toFixed":"6.0.6","daysApart":209}]}},{"cve":"CVE-2024-0057","published":"2024-01-09","fixed":"6.8.1","kev":false}],"package":"NuGet:NuGet.CommandLine"}}