CVE-2020-0884: Microsoft Visual Studio Spoofing Vulnerability
CVE-2020-0884 is a spoofing vulnerability in Microsoft Visual Studio, rated Important by Microsoft. Microsoft has not reported exploitation in the wild and rates exploitation as less likely. The EPSS model estimates a 1.67% probability of exploitation activity in the next 30 days, higher than 77% of all scored vulnerabilities. Microsoft released the fix on 10 March 2020 in the March 2020 Patch Tuesday. It affects 3 products in 1 product family (Developer Tools).
Key facts
- CVE ID
- CVE-2020-0884
- Severity
- N/A
- Microsoft severity
- Important
- Impact
- Spoofing
- Exploited in the wild
- No
- Publicly disclosed
- No
- Exploitation likelihood
- Less Likely
- Weakness
- CWE-319
- EPSS
- 1.67% (percentile 77%)
- CISA KEV
- Not listed
- Released
- Last updated
- Patch Tuesday
- March 2020 Patch Tuesday
- Product families
- Developer Tools
Description
A spoofing vulnerability exists in Microsoft Visual Studio as it includes a reply URL that is not secured by SSL. An attacker who successfully exploited this vulnerability could compromise the access tokens, exposing security and privacy risks.
To exploit this vulnerability, an attacker would need to monitor the network traffic between a client machine and server while the end user is developing an Outlook Web Add-in, and the client also has two-factor authentication enabled in Outlook.
The update addresses the vulnerability by securing the reply URL with HTTPS.
Affected products (3)
Developer Tools
| Product | Security update | Type | Fixed build | Restart |
|---|---|---|---|---|
| Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8) | Release Notes | Security Update | Maybe | |
| Microsoft Visual Studio 2019 version 16.0 | Release Notes | Security Update | Maybe | |
| Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3) | Release Notes | Security Update | Maybe |
NIST NVD data
- NVD status
- Modified
- NVD CVSS
- 3.7 (LOW)
- NVD weakness
- CWE-319
- Published to NVD
- NVD last modified
Affected configurations (CPE)
| Product | Vulnerable versions |
|---|---|
| visual studio 2017 | from 15.1, up to and including 15.8 |
| visual studio 2019 | from 16.0, up to and including 16.3 |
References
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0884 (Patch, Vendor Advisory)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0884 (Patch, Vendor Advisory)
Acknowledgments
- Microsoft Corporation
Revision history
| Version | Date | Description |
|---|---|---|
| 1.0 | Information published. |