Описание
Visual Studio Live Share Spoofing Vulnerability
A spoofing vulnerability exists in Visual Studio Live Share when a guest connected to a Live Share session is redirected to an arbitrary URL specified by the session host. An attacker who successfully exploited this vulnerability could cause a connected guest's computer to open a browser and navigate to a URL without consent from the guest.
To exploit the vulnerability, an attacker would need to host a Live Share session and convince a targeted user to connect to the session.
The update addresses the vulnerability by prompting the Live Share guest for consent prior to browsing to the host-specified URL.
FAQ
I want to install the latest supported service baseline for Visual Studio. Do I need to install the previous versions first?
No. For both Visual Studio 2019 and Visual Studio 2017, the latest supported servicing baseline is cumulative. For example, if you need to install Visual Studio 2019 version 16.4 you do NOT first have to install any previous versions. See Visual Studio 2019 version 16.4 Release Notes for more information.
Обновления
| Продукт | Статья | Обновление |
|---|---|---|
| Microsoft Visual Studio 2019 version 16.0 | ||
| Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3) | ||
| Microsoft Visual Studio Live Share extension | ||
| Microsoft Visual Studio Code Live Share extension |
Показывать по
Возможность эксплуатации
Publicly Disclosed
Exploited
Latest Software Release
Older Software Release
EPSS
Связанные уязвимости
A spoofing vulnerability exists in Visual Studio Live Share when a guest connected to a Live Share session is redirected to an arbitrary URL specified by the session host, aka 'Visual Studio Live Share Spoofing Vulnerability'.
A spoofing vulnerability exists in Visual Studio Live Share when a guest connected to a Live Share session is redirected to an arbitrary URL specified by the session host, aka 'Visual Studio Live Share Spoofing Vulnerability'.
Уязвимость расширения Live Share средства разработки программного обеспечения Microsoft Visual Studio, позволяющая нарушителю перенаправить пользователя на вредоносный URL
EPSS