#VU91701 Security features bypass in Visual Studio - CVE-2024-29060
Vulnerability identifier: #VU91701
Vulnerability risk: High
CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]
CVE-ID: CVE-2024-29060
CWE-ID:
CWE-254
Exploitation vector: Network
Exploit availability: No
Vulnerable software:
Visual Studio
Universal components / Libraries /
Software for developers
Vendor: Microsoft
Description
The vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to an error when handling extensions. A remote attacker can trick the victim to install a malicious extension and execute arbitrary code on the system.
Mitigation
Install updates from vendor's website.
Vulnerable software versions
Visual Studio: 15.0 26228.04, 15.0 26228.09, 15.0 26228.10, 15.0 26228.12, 15.0 26228.13, 15.0 26228.16, 15.0 26228.17, 15.0 26228.18, 15.0 26228.21, 15.0 26228.23, 15.0 26228.26, 15.0 26228.29, 15.0 26228.30, 15.0 26228.31, 15.0 26228.37, 15.0 26228.43, 15.0 26228.46, 15.0 26228.49, 15.0 26228.52, 15.0 26228.57, 15.0 26228.64, 15.0 26228.73, 15.0 26228.76, 15.0 26228.84, 15.0 26228.88, 15.0 26228.92, 15.0 26228.96, 15.0 26228.98, 15.0 26228.102, 15.1 26403.0 - 15.1.2 26403.07, 15.2 26430.04 - 15.2.5, 15.3 - 15.3.5, 15.4.0 - 15.4.5, 15.5 - 15.5.7, 15.6 - 15.6.7, 15.7 Preview - 15.7.6, 15.8 Preview - 15.8.9, 15.9 - 15.9.62, 16.0 - 16.0.22 16.0.28803.916, 16.1 - 16.11.36 16.11.34902.97, 16.2 - 16.2.5 16.2.29306.81, 16.3 - 16.3.10 16.3.29519.87, 16.4 - 16.4.27 16.4.31728.76, 16.5 - 16.5.5 16.5.30104.148, 16.6 - 16.6.5 16.6.30320.27, 16.7 - 16.7.28 16.7.32413.119, 16.8 - 16.8.7 16.8.31025.109, 16.9 - 16.9.26 16.9.32930.78, 17.0.0 17.0.31903.59 - 17.0.23 17.0.33829.163, 17.1.0 17.1.32210.238 - 17.10.1 17.10.34928.147, 17.2.0 17.2.32505.173 - 17.2.23 17.2.34408.132, 17.3.0 17.3.32804.467 - 17.3.7 17.3.33027.108, 17.4.0 17.4.33103.184 - 17.4.19 17.4.34902.99, 17.5.0 17.5.33414.496 - 17.5.5 17.5.33627.172, 17.6.0 17.6.33712.159 - 17.6.15 17.6.34902.100, 17.7.0 17.7.34003.232 - 17.7.7 17.7.34302.85, 17.8.0 17.8.34309.116 - 17.8.10 17.8.34902.127, 17.9.0 17.9.34607.119 - 17.9.7 17.9.34902.65
External links
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2024-29060
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
