Описание
Visual Studio Code Security Feature Bypass Vulnerability
Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
FAQ
According to the CVSS metric, a successful exploitation could lead to a scope change (S:C). What does this mean for this vulnerability?
An exploited vulnerability can affect resources beyond the security scope managed by the security authority of the vulnerable component. In this case, the vulnerable component and the impacted component are different and managed by different security authorities.
According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?
Exploitation would require a user to open or view a maliciously crafted notebook so that the affected content is rendered.
Возможность эксплуатации
Publicly Disclosed
Exploited
Latest Software Release
EPSS
6.3 Medium
CVSS3
Связанные уязвимости
Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
Уязвимость редактора исходного кода Microsoft Visual Studio Code, связанная с ошибками при обработке информации, позволяющая нарушителю обойти существующие ограничения безопасности
EPSS
6.3 Medium
CVSS3