« Volver al listado

CVE-2019-1351

Estado: ModificadaAlta (7.5)—💥 PoC

A tampering vulnerability exists when Git for Visual Studio improperly handles virtual drive paths, aka 'Git for Visual Studio Tampering Vulnerability'.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

💥 Exploits públicos

Hay código de explotación o plantillas de detección públicos. No es lo mismo que explotación activa confirmada (KEV), pero aumenta el riesgo: parchee con prioridad.

⚠️ Las pruebas de concepto de GitHub no están verificadas: algunas son falsas o contienen malware. No las ejecute nunca fuera de un laboratorio aislado.

Tecnologías afectadas (3)

Microsoft — Visual Studio 2017Microsoft — Visual Studio 2019Opensuse — Leap

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2019-1351",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "secure@microsoft.com",
      "affectedData": [
        {
          "vendor": "Microsoft",
          "product": "Microsoft Visual Studio 2017 version 15.9 (includes 15.1 - 15.8)",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified"
            }
          ]
        },
        {
          "vendor": "Microsoft",
          "product": "Microsoft Visual Studio 2017",
          "versions": [
            {
              "status": "affected",
              "version": "15.0"
            }
          ]
        },
        {
          "vendor": "Microsoft",
          "product": "Microsoft Visual Studio 2019",
          "versions": [
            {
              "status": "affected",
              "version": "16.0"
            }
          ]
        },
        {
          "vendor": "Microsoft",
          "product": "Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3)",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-01-24T21:15:12.863",
  "references": [
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html",
      "source": "secure@microsoft.com"
    },
    {
      "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1351",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "secure@microsoft.com"
    },
    {
      "url": "https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/",
      "source": "secure@microsoft.com"
    },
    {
      "url": "https://security.gentoo.org/glsa/202003-30",
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1351",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://security.gentoo.org/glsa/202003-30",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-706"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A tampering vulnerability exists when Git for Visual Studio improperly handles virtual drive paths, aka 'Git for Visual Studio Tampering Vulnerability'."
    },
    {
      "lang": "es",
      "value": "Se presenta una vulnerabilidad de manipulación cuando Git para Visual Studio maneja inapropiadamente las rutas de unidades virtuales, también se conoce como \"Git for Visual Studio Vulnerability\"."
    }
  ],
  "lastModified": "2026-06-17T02:28:26.453",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microsoft:visual_studio_2017:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "10449533-62C1-48C0-83DA-DE23AB348D78",
              "versionEndExcluding": "15.9.18",
              "versionStartIncluding": "15.0"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:visual_studio_2019:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "82C0D6F5-7300-418C-8024-24741B226036",
              "versionEndExcluding": "16.4.1",
              "versionStartIncluding": "16.0"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B620311B-34A3-48A6-82DF-6F078D7A4493"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secure@microsoft.com"
}