CVE-2019-0537
published 2019-01-08CVE-2019-0537: An information disclosure vulnerability exists when Visual Studio improperly discloses arbitrary file contents if the victim opens a malicious .vscontent file…
PriorityP274medium5.5CVSS 3.0
AVLACLPRNUIRSUCHINAN
ITWVulnCheck KEV
Exploited in the wild
EPSS
7.61%
94.6th percentile
An information disclosure vulnerability exists when Visual Studio improperly discloses arbitrary file contents if the victim opens a malicious .vscontent file, aka "Microsoft Visual Studio Information Disclosure Vulnerability." This affects Microsoft Visual Studio.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | microsoft_visual_studio | — | — |
| microsoft | microsoft_visual_studio | — | — |
| microsoft | visual_studio | — | — |
| microsoft | visual_studio | — | — |
| msrc | microsoft_visual_studio_2010_service_pack_1 | — | — |
| msrc | microsoft_visual_studio_2012_update_5 | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Trigger file type for the vulnerability is a malicious .vscontent file opened in Visual Studio ↗
- →Attack vector requires social engineering to deliver a malicious .vscontent file to a developer and have them open it in a vulnerable Visual Studio version ↗
- →Impact is unauthorized file system read access — monitor for Visual Studio processes reading unexpected or sensitive file paths after opening .vscontent files ↗
- ·No public exploit exists and exploitation is rated 'Less Likely' for both latest and older software releases ↗
- ·The vulnerability is fixed by correcting how Visual Studio loads .vscontent files; patched builds are referenced via aka.ms/vs/10/release/4476698 and aka.ms/vs/11/release/4476755 ↗
CVSS provenance
nvdv3.05.5MEDIUMCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
vulncheck5.5MEDIUM
vendor_msrc5.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Microsoft
Microsoft Visual Studio Information Disclosure Vulnerability
vendor_msrc·2019-01-08·CVSS 5.5
CVE-2019-0537 [MEDIUM] Microsoft Visual Studio Information Disclosure Vulnerability
Microsoft Visual Studio Information Disclosure Vulnerability
Description: An information disclosure vulnerability exists when Visual Studio improperly discloses arbitrary file contents if the victim opens a malicious .vscontent file. An attacker who took advantage of this information disclosure could view arbitrary file contents from the computer where the victim launched Visual Studio.
To take advantage of the vulnerability, an attacker would need to trick a user into opening a malicious .vscontent file using a vulnerable version of Visual Studio. An attacker would have no way to force a developer to produce this information disclosure.
The security update addresses the vulnerability by correcting how Visual Studio loads .vscontent files.
FAQ: What type of information could be disclosed
GHSA
GHSA-j22w-3p2c-jwhf: An information disclosure vulnerability exists when Visual Studio improperly discloses arbitrary file contents if the victim opens a malicious
ghsa_unreviewed·2022-05-13
CVE-2019-0537 [MEDIUM] GHSA-j22w-3p2c-jwhf: An information disclosure vulnerability exists when Visual Studio improperly discloses arbitrary file contents if the victim opens a malicious
An information disclosure vulnerability exists when Visual Studio improperly discloses arbitrary file contents if the victim opens a malicious .vscontent file, aka "Microsoft Visual Studio Information Disclosure Vulnerability." This affects Microsoft Visual Studio.
VulnCheck
Microsoft Visual Studio Information Disclosure Vulnerability
vulncheck·2019·CVSS 5.5
CVE-2019-0537 [MEDIUM] Microsoft Visual Studio Information Disclosure Vulnerability
Microsoft Visual Studio Information Disclosure Vulnerability
An information disclosure vulnerability exists when Visual Studio improperly discloses arbitrary file contents if the victim opens a malicious .vscontent file, aka "Microsoft Visual Studio Information Disclosure Vulnerability." This affects Microsoft Visual Studio.
Affected: Microsoft visual_studio
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://www.fortinet.com/content/dam/fortinet/assets/threat-reports/threat-landscape-report-2h-2023.pdf
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2019-01-08
Published
Exploited in the wild