Security readout for executives and security teams
Plain-English summary
CVE-2023-35373 is a Mono Authenticode validation spoofing flaw. In business terms, affected systems could make an incorrect trust decision about signed content. The recorded severity is medium, but confidentiality impact is rated high, so exposure matters where Mono is part of software trust, build, or validation workflows.
Executive priority
Treat as a moderate-priority remediation item, raised in priority for software supply chain, signing, build, or validation systems. It is not KEV-listed, but incorrect trust decisions can create business risk in sensitive delivery pipelines.
Technical view
The source bundle identifies a CWE-347 signature verification issue affecting Microsoft Mono 6.12.0. CVSS 3.1 is 5.3 with network attack vector, high attack complexity, low privileges required, no user interaction, and high confidentiality impact. The temporal vector indicates proof-of-concept exploit maturity and official remediation availability.
Likely exposure
Likely exposure is limited to environments running Microsoft Mono 6.12.0, especially where Mono performs Authenticode validation or influences trust decisions for signed files. The bundle does not identify other affected versions or products.
Exploitation context
CISA KEV status is false in the source bundle. No provided source states active exploitation. The CVSS temporal metric lists proof-of-concept exploit maturity, but the bundle does not provide exploit details and should not be treated as evidence of broad exploitation.
Researcher notes
Evidence is narrow: the bundle names Mono 6.12.0, CWE-347, CVSS details, KEV false, and the MSRC advisory. It does not provide root-cause specifics, affected code paths, fixed version details, or active exploitation evidence.
Mitigation direction
- Inventory systems and build images for Microsoft Mono 6.12.0.
- Review MSRC guidance for the official fix or update path.
- Prioritize systems using Mono for Authenticode or signed-file trust decisions.
- Update affected Mono deployments according to vendor guidance.
- Monitor vendor advisories for any scope or remediation changes.
Validation and detection
- Confirm installed Mono versions across servers, workstations, and containers.
- Identify applications or pipelines using Mono Authenticode validation.
- Compare findings against the MSRC affected product entry.
- After remediation, verify Mono is no longer at the affected version.
- Document whether signed-content trust workflows depend on Mono.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-347: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2023-35373 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C1.63.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
5.3MediumVector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C
Source materials
- CVE List V5 sourceCVE List V5
- Mono Authenticode Validation Spoofing VulnerabilityCVE reference · vendor-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Verification of Cryptographic Signature
Improper Verification of Cryptographic Signature represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.