CVE-2019-1486

En bref

Sévérité: Non disponible
EPSS: EPSS 1.59 % · centile 75 (2026-10-27)
État: PUBLISHED
Publiée: 2019-12-10
Mise à jour: 2024-08-04
Attribuée par: microsoft
Statut NVD: Modified

Description

A spoofing vulnerability exists in Visual Studio Live Share when a guest connected to a Live Share session is redirected to an arbitrary URL specified by the session host, aka 'Visual Studio Live Share Spoofing Vulnerability'.

Scores

Version	Score	Vecteur	Évalué par
CVSS 3.1	MEDIUM 6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	NVD · nvd@nist.gov (Primary)
CVSS 2.0	MEDIUM 5.8	AV:N/AC:M/Au:N/C:P/I:P/A:N	NVD · nvd@nist.gov (Primary)

Faiblesses (CWE)

CWE-601

Références européennes

ENISA EUVD · EUVD-2019-10043
GCVE · GCVE-0-2019-1486

Avis du CERT-FR

CERTFR-2019-AVI-627 — Multiples vulnérabilités dans les produits Microsoft · cert.ssi.gouv.fr

Configurations affectées (CPE NVD)

cpe:2.3:a:microsoft:visual_studio_2019:*:*:*:*:*:*:*:* ≥ 16.0 ≤ 16.4
cpe:2.3:a:microsoft:visual_studio_live_share:*:*:*:*:*:visual_studio:*:* < 1.0.1374

Produits affectés

Produit	Versions
Microsoft · Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3)	affected unspecified
Microsoft · Microsoft Visual Studio Live Share extension	affected unspecified
Microsoft · Microsoft Visual Studio 2019	affected 16.0

Références

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1486

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD