Vulnerabilites related to Microsoft - Python extension for Visual Studio Code
CVE-2020-16977 (GCVE-0-2020-16977)
Vulnerability from cvelistv5
Published
2020-10-16 22:18
Modified
2024-08-04 13:45
Severity ?
7.0 (High) - CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
Summary
<p>A remote code execution vulnerability exists in Visual Studio Code when the Python extension loads a Jupyter notebook file. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p> <p>To exploit this vulnerability, an attacker would need to convince a target to open a specially crafted file in Visual Studio Code with the Python extension installed.</p> <p>The update addresses the vulnerability by modifying the way Visual Studio Code Python extension renders notebook content.</p>
References
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16977x_refsource_MISC
Impacted products
Vendor Product Version
Microsoft Python extension for Visual Studio Code Version: 2020   < publication
    cpe:2.3:a:microsoft:visual_studio_code:*:*:*:*:*:python:*:*
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T13:45:34.781Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16977",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               cpes: [
                  "cpe:2.3:a:microsoft:visual_studio_code:*:*:*:*:*:python:*:*",
               ],
               platforms: [
                  "Unknown",
               ],
               product: "Python extension for Visual Studio Code",
               vendor: "Microsoft",
               versions: [
                  {
                     lessThan: "publication",
                     status: "affected",
                     version: "2020",
                     versionType: "custom",
                  },
               ],
            },
         ],
         datePublic: "2020-10-13T07:00:00+00:00",
         descriptions: [
            {
               lang: "en-US",
               value: "<p>A remote code execution vulnerability exists in Visual Studio Code when the Python extension loads a Jupyter notebook file. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p>\n<p>To exploit this vulnerability, an attacker would need to convince a target to open a specially crafted file in Visual Studio Code with the Python extension installed.</p>\n<p>The update addresses the vulnerability by modifying the way Visual Studio Code Python extension renders notebook content.</p>\n",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  baseScore: 7,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
                  version: "3.1",
               },
               format: "CVSS",
               scenarios: [
                  {
                     lang: "en-US",
                     value: "GENERAL",
                  },
               ],
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "Remote Code Execution",
                     lang: "en-US",
                     type: "Impact",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-12-31T19:20:00.789Z",
            orgId: "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
            shortName: "microsoft",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16977",
            },
         ],
         title: "Visual Studio Code Python Extension Remote Code Execution Vulnerability",
      },
   },
   cveMetadata: {
      assignerOrgId: "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
      assignerShortName: "microsoft",
      cveId: "CVE-2020-16977",
      datePublished: "2020-10-16T22:18:10",
      dateReserved: "2020-08-04T00:00:00",
      dateUpdated: "2024-08-04T13:45:34.781Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2024-49050 (GCVE-0-2024-49050)
Vulnerability from cvelistv5
Published
2024-11-12 17:54
Modified
2025-01-30 00:10
Severity ?
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Summary
Visual Studio Code Python Extension Remote Code Execution Vulnerability
References
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49050vendor-advisory
Impacted products
Vendor Product Version
Microsoft Python extension for Visual Studio Code Version: 2020   < 2024.18.2
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-49050",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-11-13T04:55:45.511515Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-11-15T14:20:05.712Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               platforms: [
                  "Unknown",
               ],
               product: "Python extension for Visual Studio Code",
               vendor: "Microsoft",
               versions: [
                  {
                     lessThan: "2024.18.2",
                     status: "affected",
                     version: "2020",
                     versionType: "custom",
                  },
               ],
            },
         ],
         cpeApplicability: [
            {
               nodes: [
                  {
                     cpeMatch: [
                        {
                           criteria: "cpe:2.3:a:microsoft:visual_studio_code:*:*:*:*:*:python:*:*",
                           versionEndExcluding: "2024.18.2",
                           versionStartIncluding: "2020",
                           vulnerable: true,
                        },
                     ],
                     negate: false,
                     operator: "OR",
                  },
               ],
            },
         ],
         datePublic: "2024-11-12T08:00:00.000Z",
         descriptions: [
            {
               lang: "en-US",
               value: "Visual Studio Code Python Extension Remote Code Execution Vulnerability",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  baseScore: 8.8,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
                  version: "3.1",
               },
               format: "CVSS",
               scenarios: [
                  {
                     lang: "en-US",
                     value: "GENERAL",
                  },
               ],
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-501",
                     description: "CWE-501: Trust Boundary Violation",
                     lang: "en-US",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2025-01-30T00:10:31.354Z",
            orgId: "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
            shortName: "microsoft",
         },
         references: [
            {
               name: "Visual Studio Code Python Extension Remote Code Execution Vulnerability",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49050",
            },
         ],
         title: "Visual Studio Code Python Extension Remote Code Execution Vulnerability",
      },
   },
   cveMetadata: {
      assignerOrgId: "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
      assignerShortName: "microsoft",
      cveId: "CVE-2024-49050",
      datePublished: "2024-11-12T17:54:26.264Z",
      dateReserved: "2024-10-11T20:57:49.187Z",
      dateUpdated: "2025-01-30T00:10:31.354Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2020-17163 (GCVE-0-2020-17163)
Vulnerability from cvelistv5
Published
2023-12-29 16:24
Modified
2024-08-04 13:53
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Summary
Visual Studio Code Python Extension Remote Code Execution Vulnerability
References
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2020-17163vendor-advisory
Impacted products
Vendor Product Version
Microsoft Python extension for Visual Studio Code Version: 2020   < publication
    cpe:2.3:a:microsoft:visual_studio_code:*:*:*:*:*:python:*:*
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T13:53:16.479Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "Visual Studio Code Python Extension Remote Code Execution Vulnerability",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2020-17163",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               cpes: [
                  "cpe:2.3:a:microsoft:visual_studio_code:*:*:*:*:*:python:*:*",
               ],
               platforms: [
                  "Unknown",
               ],
               product: "Python extension for Visual Studio Code",
               vendor: "Microsoft",
               versions: [
                  {
                     lessThan: "publication",
                     status: "affected",
                     version: "2020",
                     versionType: "custom",
                  },
               ],
            },
         ],
         datePublic: "2021-03-16T07:00:00+00:00",
         descriptions: [
            {
               lang: "en-US",
               value: "Visual Studio Code Python Extension Remote Code Execution Vulnerability",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
                  version: "3.1",
               },
               format: "CVSS",
               scenarios: [
                  {
                     lang: "en-US",
                     value: "GENERAL",
                  },
               ],
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "Remote Code Execution",
                     lang: "en-US",
                     type: "Impact",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-12-29T20:08:52.546Z",
            orgId: "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
            shortName: "microsoft",
         },
         references: [
            {
               name: "Visual Studio Code Python Extension Remote Code Execution Vulnerability",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2020-17163",
            },
         ],
         title: "Visual Studio Code Python Extension Remote Code Execution Vulnerability",
      },
   },
   cveMetadata: {
      assignerOrgId: "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
      assignerShortName: "microsoft",
      cveId: "CVE-2020-17163",
      datePublished: "2023-12-29T16:24:16.265Z",
      dateReserved: "2020-08-04T00:00:00.000Z",
      dateUpdated: "2024-08-04T13:53:16.479Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}