PT-2019-1638 · Microsoft+2 · Nuget Package Manager+2

Published 2019-03-12 · Updated 2022-04-11 · CVE-2019-0757

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions NuGet Package Manager for Linux and Mac (affected versions not specified)

Description A tampering issue exists in the NuGet Package Manager that could allow an authenticated attacker to modify a NuGet package's folder structure. The vulnerability is related to insecure privilege management, which may enable a remote attacker to alter the package's folder structure.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

BDU:2019-01186

CESA-2019_1259

CVE-2019-0757

RHSA-2019:0544

RHSA-2019:1259

RHSA-2019_1259

Affected Products

Centos

Nuget Package Manager

Red Hat

References · 20

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-0757 · Security Note
• https://safe-surf.ru/specialists/bulletins-nkcki/680637 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-0820 · Security Note
• https://bdu.fstec.ru/vul/2019-01933 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-0981 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-0980 · Security Note
• https://access.redhat.com/errata/RHSA-2019:1259 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-0757 · Security Note
• https://bdu.fstec.ru/vul/2019-01186 · Security Note
• https://bdu.fstec.ru/vul/2019-02030 · Security Note
• https://bdu.fstec.ru/vul/2019-02034 · Security Note
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0757 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-0757 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-0757 · Security Note
• https://linux.oracle.com/errata/ELSA-2019-1259.html · Vendor Advisory