PT-2019-2991 · Microsoft · Git For Visual Studio+1

Rich Mirch + 1 · Published 2019-08-13 · Updated 2024-05-29 · CVE-2019-1211

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Microsoft Visual Studio (affected versions not specified) Git for Visual Studio (affected versions not specified)

Description The issue is related to errors in privilege management in the Git component of Microsoft Visual Studio. It allows an attacker to elevate their privileges. An attacker who successfully exploits the issue could execute code in the context of another local user. To exploit, an authenticated attacker would need to modify Git configuration files on a system and then convince another user to execute specific Git commands.

Recommendations For Microsoft Visual Studio, update the software to change the permissions required to edit configuration files. For Git for Visual Studio, update the software to change the permissions required to edit configuration files. As a temporary workaround, consider restricting access to Git configuration files to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2019-02970

CVE-2019-1211

Affected Products

Git For Visual Studio

Visual Studio

References · 4

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1211 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-1211 · Security Note
• https://osv.dev/vulnerability/CVE-2019-1211 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-02970 · Security Note