CVE-2019-0757: microsoft microsoft visual studio
CVSS: 6.5v3.1MediumModified
AliasesRHSA-2019:0544
Published 09-04-2019Last modified 04-08-2024
Vulnerability summary
CVE-2019-0757 is a medium (CVSS 6.5) vulnerability in microsoft microsoft visual studio. EPSS estimates a 2.70% chance of exploitation in the next 30 days, higher than 85.6% of scored vulnerabilities.
CVSS score
6.5/10
010
Medium · v3.1 (NVD)EPSS score
2.70%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 1Timeline
- 09-04-2019PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
A tampering vulnerability exists in the NuGet Package Manager for Linux and Mac that could allow an authenticated attacker to modify a NuGet package's folder structure, aka 'NuGet Package Manager Tampering Vulnerability'.
CVSS metrics
3 scores · 2 sources · 3 versionsMedium 6.5Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:NSourcesSingle source
High 7.8Preferred score · OSV · Red hat (Ecosystem advisory) · calculated from vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HSourcesSingle source
Medium 4.0Preferred score · NVD (NIST)
AV:N/AC:L/Au:S/C:N/I:P/A:NSourcesSingle source
EPSS trend
Probability
2.70%
Chance of exploitation in the next 30 days
Percentile
86%
Versus all other CVEs
30-day change
0.00 pp
From 2.70% on 19-09-2026
19-09-202619-10-2026
EPSS score2.70%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Redhat25 products
- enterprise_linux8.0
- enterprise_linux_eus8.1 | 8.2 | 8.4
- enterprise_linux_server_aus8.2 | 8.4
- enterprise_linux_server_tus8.2 | 8.4
- rh-dotnet21< 0:2.1-8.el7
Microsoft5 products
- microsoft visual studio2017 for Mac
- mono framework5.18.0.223 | 5.20.0
- .net_core_sdk1.1 on .NET Core 1.0 | 2.1.500 on .NET Core 2.1 | 2.2.100 on .NET Core 2.2 | 1.1 on .NET Core 1.1 | 1.1 | 2.1.500 | 2.2.100
- nuget4.3.1 | 4.4.2 | 4.5.2 | 4.6.3 | 4.7.2 | 4.8.2 | 4.9.4
- visual_studio_2017na
Mono-project1 product
- mono_framework5.18.0.223 | 5.20.0
3 vendors · 31 products
References
11 links
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0757X Refsource CONFIRMPatchVendor AdvisoryARTICLE
