PT-2019-2257 · Microsoft · Nuget Package Manager

Published 2019-05-14 · Updated 2022-05-24 · CVE-2019-0976

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions NuGet Package Manager (affected versions not specified)

Description The issue is related to insufficient access control in the NuGet package management system. It allows an authenticated attacker to modify the contents of the intermediate build folder, which by default is obj. This could potentially compromise the integrity of protected information by altering the build directory.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Permission

Improper Access Control

Weakness Enumeration

CWE-732

CWE-284

Related Identifiers

BDU:2019-02028

CVE-2019-0976

GHSA-3HCM-6FJC-47QQ

Affected Products

Nuget Package Manager

References · 10

• https://bdu.fstec.ru/vul/2019-02028 · Security Note
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0976 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3hcm-6fjc-47qq · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-0976 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-0976 · Security Note
• https://github.com/NuGet/Home/issues/7908 · Note
• https://github.com/NuGet/NuGet.Client · Note
• https://github.com/NuGet/NuGet.Client/commit/e32a2ea7096debd3e513188f6779bb1041593326 · Note
• http://securityfocus.com/bid/108210 · Note
• https://web.archive.org/web/20200227075944/http://securityfocus.com/bid/108210 · Note