CVE-2021-26434

CWE-732 — Incorrect Permission Assignment CWE-269 — Improper Privilege Management4 documents4 sources

Severity

7.8HIGH

EPSS

0.4%

top 37.00%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

7

Microsoft Microsoft Visual Studio 2017 Version 15.9 (includes 15.0 - 15.8)Microsoft Microsoft Visual Studio 2019 Version 16.11 (includes 16.0 - 16.10)Microsoft Microsoft Visual Studio 2019 Version 16.4 (includes 16.0 - 16.3)+4 more

Timeline

PublishedSep 15

Latest updateMay 24

Description

Visual Studio Elevation of Privilege Vulnerability

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages7 packages

▶CVEListV5microsoft/microsoft_visual_studio_2017_version_15.9_(includes_15.0_-_15.8)15.9.0 — 15.9.39

▶CVEListV5microsoft/microsoft_visual_studio_2019_version_16.4_(includes_16.0_-_16.3)16.0 — 16.4.26

▶CVEListV5microsoft/microsoft_visual_studio_2019_version_16.7_(includes_16.0_–_16.6)16.0.0 — 16.7.19

▶CVEListV5microsoft/microsoft_visual_studio_2019_version_16.9_(includes_16.0_-_16.8)15.0.0 — 16.9.11

▶CVEListV5microsoft/microsoft_visual_studio_2019_version_16.11_(includes_16.0_-_16.10)16.11.0 — 16.11.3

Patches

Patch: portal.msrc.microsoft.com ↗Patch: portal.msrc.microsoft.com ↗

🔴Vulnerability Details

2

GHSA

GHSA-8qhp-jq8m-c4m4: Visual Studio Elevation of Privilege Vulnerability↗2022-05-24

▶

CVEList

Visual Studio Elevation of Privilege Vulnerability↗2021-09-15

▶

📋Vendor Advisories

1

Microsoft

Visual Studio Elevation of Privilege Vulnerability↗2021-09-14

▶

CVE-2021-26434 (HIGH CVSS 7.8) | Visual Studio Elevation of Privileg | cvebase.io