PT-2019-2991 · Microsoft · Git For Visual Studio+1

Rich Mirch + 1 · Publicado 2019-08-13 · Atualizado 2024-05-29 · CVE-2019-1211

Positive Technologies (AI Summary)

CVSS v3.1

7.3

Alta

Vetor base

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Microsoft Visual Studio (affected versions not specified) Git for Visual Studio (affected versions not specified)

Description The issue is related to errors in privilege management in the Git component of Microsoft Visual Studio. It allows an attacker to elevate their privileges. An attacker who successfully exploits the issue could execute code in the context of another local user. To exploit, an authenticated attacker would need to modify Git configuration files on a system and then convince another user to execute specific Git commands.

Recommendations For Microsoft Visual Studio, update the software to change the permissions required to edit configuration files. For Git for Visual Studio, update the software to change the permissions required to edit configuration files. As a temporary workaround, consider restricting access to Git configuration files to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

BDU:2019-02970

CVE-2019-1211

Produtos afetados

Git For Visual Studio

Visual Studio

Referências · 4

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1211 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-1211 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-1211 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2019-02970 · Nota de Segurança