CVE-2024-0057

The vulnerability results from improper validation of input data (CWE-20) in .NET, .NET Framework and Visual Studio components. An attacker can remotely, without authentication and without user interaction, provide specially crafted input data that results in bypassing built-in security control mechanisms. The attack vector is network-based, and low attack complexity means that its execution does not require advanced skills or special conditions.

Successful exploitation of the vulnerability allows an attacker to bypass application security measures and compromise the confidentiality and integrity of processed data. It does not directly affect system availability.

Apply patches available from the vendor in accordance with the references — updates were published by Microsoft as part of the January 2024 Patch Tuesday. Detailed information about patched versions is available at: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-0057

Microsoft PowerShell, Microsoft Visual Studio 2022 and .NET and .NET Framework environments — exact versions indicated in the vendor's references (Microsoft Security Response Center).