CVE-2020-1416

An elevation of privilege vulnerability exists in Visual Studio and Visual Studio Code when they load software dependencies, aka 'Visual Studio and Visual Studio Code Elevation of Privilege Vulnerability'.

CVSS v3 8.8 HIGH
CVSS v2.0 9.3 HIGH

8.8^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

9.3^/10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability : 8.6 / Impact : 10.0

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1416	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:microsoft:azure_storage_explorer:-:::::::*
	cpe:2.3:a:microsoft:typescript:-:::::::*
	cpe:2.3:a:microsoft:visual_studio_2017::::::::
	cpe:2.3:a:microsoft:visual_studio_2019::::::::
	cpe:2.3:a:microsoft:visual_studio_2019::::::::
	cpe:2.3:a:microsoft:visual_studio_2019::::::::
	cpe:2.3:a:microsoft:visual_studio_code::::::::

History

09 Mar 2023, 18:02

Type	Values Removed	Values Added
First Time		Microsoft visual Studio 2017 Microsoft azure Storage Explorer Microsoft typescript Microsoft visual Studio Code Microsoft visual Studio 2019
CPE	cpe:2.3:o:microsoft:windows_10:2004::::::x64: cpe:2.3:o:microsoft:windows_10:1803::::::x86: cpe:2.3:o:microsoft:windows_10:1803::::::arm64: cpe:2.3:o:microsoft:windows_server_2008:-:sp2:::::x64:* cpe:2.3:o:microsoft:windows_10:-::::::x64: cpe:2.3:o:microsoft:windows_server_2016:1909:::::::* cpe:2.3:o:microsoft:windows_8.1:-::::::x64: cpe:2.3:o:microsoft:windows_10:1909::::::x64: cpe:2.3:o:microsoft:windows_10:1809::::::x86: cpe:2.3:o:microsoft:windows_10:1903::::::arm64: cpe:2.3:o:microsoft:windows_10:1809::::::x64: cpe:2.3:o:microsoft:windows_server_2008:-:sp2:::::x86:* cpe:2.3:o:microsoft:windows_10:1607::::::x86: cpe:2.3:o:microsoft:windows_10:1709::::::arm64: cpe:2.3:o:microsoft:windows_server_2016:1903:::::::* cpe:2.3:o:microsoft:windows_rt_8.1:-:::::::* cpe:2.3:o:microsoft:windows_10:1903::::::x64: cpe:2.3:o:microsoft:windows_server_2016:2004:::::::* cpe:2.3:o:microsoft:windows_10:2004::::::x86: cpe:2.3:o:microsoft:windows_server_2012:-:::::::* cpe:2.3:o:microsoft:windows_10:1709::::::x64: cpe:2.3:o:microsoft:windows_10:1709::::::x86: cpe:2.3:o:microsoft:windows_7:-:sp1:::::x64:* cpe:2.3:o:microsoft:windows_10:1607::::::x64: cpe:2.3:o:microsoft:windows_10:1903::::::x86: cpe:2.3:o:microsoft:windows_10:-::::::x86: cpe:2.3:o:microsoft:windows_8.1:-::::::x86: cpe:2.3:o:microsoft:windows_10:1809::::::arm64: cpe:2.3:o:microsoft:windows_10:1803::::::x64: cpe:2.3:o:microsoft:windows_server_2016:-:::::::* cpe:2.3:o:microsoft:windows_7:-:sp1:::::x86:* cpe:2.3:o:microsoft:windows_server_2012:r2:::::::* cpe:2.3:o:microsoft:windows_10:2004::::::arm64: cpe:2.3:o:microsoft:windows_server_2019:-:::::::* cpe:2.3:o:microsoft:windows_10:1909::::::arm64: cpe:2.3:o:microsoft:windows_10:1909::::::x86:	cpe:2.3:a:microsoft:visual_studio_code:::::::: cpe:2.3:a:microsoft:azure_storage_explorer:-:::::::* cpe:2.3:a:microsoft:visual_studio_2019:::::::: cpe:2.3:a:microsoft:visual_studio_2017:::::::: cpe:2.3:a:microsoft:typescript:-:::::::*

30 Sep 2021, 13:15

Type	Values Removed	Values Added
References	{'url': 'https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-info-exp-8RsuEu8S', 'name': '20210217 Cisco Identity Services Engine Sensitive Information Disclosure Vulnerabilities', 'tags': ['Not Applicable'], 'refsource': 'CISCO'}

19 Feb 2021, 17:48

Type	Values Removed	Values Added
References	~~(CISCO) https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-info-exp-8RsuEu8S -~~	(CISCO) https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-info-exp-8RsuEu8S - Not Applicable

17 Feb 2021, 18:15

Type	Values Removed	Values Added
References		(CISCO) https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-info-exp-8RsuEu8S -

Information

Published : 2020-07-14 23:15

Updated : 2023-12-10 13:27

NVD link : CVE-2020-1416

Mitre link : CVE-2020-1416

CVE.ORG link : CVE-2020-1416

JSON object : View

Products Affected

microsoft

azure_storage_explorer
visual_studio_2019
visual_studio_code
typescript
visual_studio_2017

CWE

CWE-269

Improper Privilege Management

8.8 /10