CVE-2019-1077

At a glance

Severity: Not available
EPSS: EPSS 1.75 % · percentile 78 (2026-10-27)
State: PUBLISHED
Published: 2019-07-15
Updated: 2024-08-04
Assigner: microsoft
NVD status: Modified

Description

An elevation of privilege vulnerability exists when the Visual Studio updater service improperly handles file permissions, aka 'Visual Studio Elevation of Privilege Vulnerability'.

Scores

Version	Score	Vector	Scored by
CVSS 3.0	MEDIUM 5.0	CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N	NVD · nvd@nist.gov (Primary)
CVSS 2.0	MEDIUM 6.6	AV:L/AC:L/Au:N/C:N/I:C/A:C	NVD · nvd@nist.gov (Primary)

European references

ENISA EUVD · EUVD-2019-9658
GCVE · GCVE-0-2019-1077

CERT-FR advisories

CERTFR-2019-AVI-322 — Multiples vulnérabilités dans les produits Microsoft · cert.ssi.gouv.fr

Affected configurations (NVD CPE)

cpe:2.3:a:microsoft:visual_studio_2017:15.9:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:visual_studio_2019:16.0:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:visual_studio_2019:16.1:*:*:*:*:*:*:*

Affected products

Product	Versions
Microsoft · Microsoft Visual Studio 2017	affected version 15.9
Microsoft · Microsoft Visual Studio 2019	affected 16.0 ; affected 16.1

References

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1077

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD