Vulnerability · Published May 11, 2021 · Assigned by microsoft
CVE-2021-31204.NET and Visual Studio Elevation of Privilege Vulnerability
High 7.3
In plain English
A high-severity privilege mismanagement in Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3) from Microsoft. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 68% of all known vulnerabilities).
Severity (CVSS 3.1)7.3High
Exploit odds (30 days)1.2%top 31.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
.NET and Visual Studio Elevation of Privilege Vulnerability
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Microsoft | .NET Core 3.1 | 3.1 – before 3.1.15-servicing.21214.3 |
| Microsoft | .NET 5.0 | 5.0.0 – before 5.0.6-servicing.21220.11 |
| Microsoft | Microsoft Visual Studio 2019 version 16.9 (includes 16.0 - 16.8) | 15.0.0 – before publication |
| Microsoft | Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3) | 16.0 – before publication |
| Microsoft | Microsoft Visual Studio 2019 version 16.7 (includes 16.0 – 16.6) | 16.0.0 – before publication |
| Microsoft | Visual Studio 2019 for Mac version 8.9 | 8.0 – before publication |
Weakness: CWE-269 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
References
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-31204 x_refsource_MISC
- FEDORA-2021-a3c205f5b2 vendor-advisory, x_refsource_FEDORA
- FEDORA-2021-13e3bd248f vendor-advisory, x_refsource_FEDORA
- FEDORA-2021-721731dc86 vendor-advisory, x_refsource_FEDORA
- FEDORA-2021-c06b64b5ee vendor-advisory, x_refsource_FEDORA
- FEDORA-2021-f25eb9e302 vendor-advisory, x_refsource_FEDORA
- FEDORA-2021-d551431950 vendor-advisory, x_refsource_FEDORA