PT-2020-2937 · Microsoft · Visual Studio Code Live Share Extension

Fredrik Hoxell · Published 2020-06-09 · Updated 2021-07-21 · CVE-2020-1343

Positive Technologies (AI Summary)

CVSS v2.0

5.4

Medium

Base vector

AV:N/AC:H/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Visual Studio Code Live Share Extension (affected versions not specified)

Description An information disclosure issue exists in Visual Studio Code Live Share Extension, where it exposes tokens in plain text. This could allow a remote attacker to gain unauthorized access to protected information by intercepting the token from the client to the server using a special server configuration.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Cleartext Transmission of Sensitive Information

Information Disclosure

Weakness Enumeration

CWE-319

CWE-200

Related Identifiers

BDU:2020-03094

CVE-2020-1343

Affected Products

Visual Studio Code Live Share Extension

References · 4

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1343 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-03094 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-1343 · Security Note
• https://t.me/cvenotify/4264 · Telegram Post