CVE-2019-1077
Description
An elevation of privilege vulnerability exists when the Visual Studio updater service improperly handles file permissions, aka Visual Studio Elevation of Privilege Vulnerability.
Risk Information
Base Score
5.0
MODERATE
Vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N
EPSS Score
Exploitation Probability
0.557
Associated Vulnerability
| Vulnerability | OS Platform |
|---|---|
| Visual Studio Information Disclosure Vulnerability for the information disclosure vulnerability in Microsoft Visual Studio 2010 Service Pack 1 (KB4506161) | Windows |
| Visual Studio Information Disclosure Vulnerability for the information disclosure vulnerability in Microsoft Visual Studio 2013 Update 5 (KB4506163) | Windows |
| Visual Studio Information Disclosure Vulnerability for the information disclosure vulnerability in Microsoft Visual Studio 2012 Update 5 (KB4506162) | Windows |
| Microsoft Defender for Endpoint Spoofing Vulnerability for the information disclosure vulnerability in Microsoft Visual Studio 2015 Update 3 (KB4506164) | Windows |
| Multiple Vulnerabilities are affected in Microsoft Visual Studio Community 2017 15.9 | Windows |
| Multiple Vulnerabilities are affected in Microsoft Visual Studio Community 2019 16.0 | Windows |
| Vulnerabilities CVE-2019-1077 are affected in Microsoft Visual Studio Community 2019 16.1 | Windows |
| Multiple Vulnerabilities are affected in Microsoft Visual Studio Enterprise 2017 15.9 | Windows |
| Multiple Vulnerabilities are affected in Microsoft Visual Studio Enterprise 2019 16.0 | Windows |
| Vulnerabilities CVE-2019-1077 are affected in Microsoft Visual Studio Enterprise 2019 16.1 | Windows |
| Multiple Vulnerabilities are affected in Microsoft Visual Studio Professional 2017 15.9 | Windows |
| Multiple Vulnerabilities are affected in Microsoft Visual Studio Professional 2019 16.0 | Windows |
| Vulnerabilities CVE-2019-1077 are affected in Microsoft Visual Studio Professional 2019 16.1 | Windows |
Patch Details
Click to see the patches provided by ManageEngine for this CVE
| Patch ID | Patch Description |
|---|---|
| PATCH-27172 | Security update for the information disclosure vulnerability in Microsoft Visual Studio 2010 Service Pack 1 (KB4506161) |
| PATCH-27184 | Security update for the information disclosure vulnerability in Microsoft Visual Studio 2013 Update 5 (KB4506163) |
| PATCH-27173 | Security update for the information disclosure vulnerability in Microsoft Visual Studio 2012 Update 5 (KB4506162) |
References
https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234