Skip to main content

Visual Studio 2017 CVE-2021-26434

HIGH
Incorrect Permission Assignment for Critical Resource (CWE-732)
2021-09-15 secure@microsoft.com
Information Disclosure Visual Studio 2017 Visual Studio 2019
7.8
CVSS 3.1 · Vendor: microsoft
Share

Severity by source

Vendor (microsoft) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (microsoft) · only source for this CVE.

CVSS VectorVendor: microsoft

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Sep 15, 2021 - 12:15 cve.org
HIGH 7.8

DescriptionCVE.org

Visual Studio Elevation of Privilege Vulnerability

AnalysisAI

Visual Studio Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Incorrect Permission Assignment vulnerability could allow attackers to access resources due to misconfigured permissions.

Technical ContextAI

This vulnerability is classified as Incorrect Permission Assignment (CWE-732), which allows attackers to access resources due to misconfigured permissions. Affected products include: Microsoft Visual Studio 2017, Microsoft Visual Studio 2019.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Review and restrict file/resource permissions, apply principle of least privilege.

More in Visual Studio 2017

View all
CVE-2020-1147 HIGH POC
7.8 Jul 14

A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the softwar
CVE-2018-0952 HIGH POC
7.8 Aug 15

An Elevation of Privilege vulnerability exists when Diagnostics Hub Standard Collector allows file creation in arbitrary
CVE-2020-26870 MEDIUM POC
6.1 Oct 07

Cure53 DOMPurify before 2.0.17 allows mutation XSS. Rated medium severity (CVSS 6.1), this vulnerability is remotely exp
CVE-2025-49739 HIGH
8.8 Jul 08

Improper link resolution before file access ('link following') in Visual Studio allows an unauthorized attacker to eleva
CVE-2022-35827 HIGH
8.8 Aug 09

Visual Studio Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploi
CVE-2022-35826 HIGH
8.8 Aug 09

Visual Studio Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploi
CVE-2022-35825 HIGH
8.8 Aug 09

Visual Studio Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploi
CVE-2022-35777 HIGH
8.8 Aug 09

Visual Studio Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploi
CVE-2020-1416 HIGH
8.8 Jul 14

An elevation of privilege vulnerability exists in Visual Studio and Visual Studio Code when they load software dependenc
CVE-2019-1113 HIGH
8.8 Jul 15

A remote code execution vulnerability exists in .NET software when the software fails to check the source markup of a fi
CVE-2019-0613 HIGH
8.8 Mar 05

A remote code execution vulnerability exists in .NET Framework and Visual Studio software when the software fails to che
CVE-2023-36897 HIGH
8.1 Aug 08

Visual Studio Tools for Office Runtime Spoofing Vulnerability. Rated high severity (CVSS 8.1), this vulnerability is rem

Same weakness CWE-732 – Incorrect Permission Assignment for Critical Resource

View all
CVE-2017-9462 HIGH POC
8.8
CVE-2017-3006 HIGH POC
8.8
CVE-2017-9602 CRITICAL POC
9.8
CVE-2022-22960 HIGH POC
7.8
CVE-2021-38085 HIGH POC
7.8
CVE-2021-35449 HIGH POC
7.8
CVE-2020-11855 HIGH POC
7.8
CVE-2020-10883 HIGH POC
7.8

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Share

CVE-2021-26434 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy