Medium severity · published Apr 15, 2020
CVE-2020-0900
An elevation of privilege vulnerability exists when the Visual Studio Extension Installer Service improperly handles file operations, aka 'Visual Studio Extension Installer…
5.5
CVSS
0.8%
EPSS
No
On KEV
Description
An elevation of privilege vulnerability exists when the Visual Studio Extension Installer Service improperly handles file operations, aka 'Visual Studio Extension Installer Service Elevation of Privilege Vulnerability'.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 57% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VS
Visual Studio 2015 · Microsoft
update_3 · source: NVD
VS
Visual Studio 2017 · Microsoft
15.9 · source: NVD
VS
Visual Studio 2019 · Microsoft
16.0; 16.4; 16.5.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-0900
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-0900
Patch
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0900
More from Visual Studio 2015
7.8
CVE-2020-0810
An elevation of privilege vulnerability exists when the Diagnostics Hub Standard Collector or the Visual Studio Standard Collector allows file creation in arbitrary locations.To…
7.8
CVE-2020-0793
An elevation of privilege vulnerability exists when the Diagnostics Hub Standard Collector Service improperly handles file operations, aka 'Diagnostics Hub Standard Collector…
7.8
CVE-2018-0952
An Elevation of Privilege vulnerability exists when Diagnostics Hub Standard Collector allows file creation in arbitrary locations, aka "Diagnostic Hub Standard Collector…