CVE-2021-28792

Опубликовано: 18 мар. 2021

Источник: nvd

CVSS3: 7.8

CVSS2: 6.8

EPSS Низкий

Описание

The unofficial Swift Development Environment extension before 2.12.1 for Visual Studio Code allows remote attackers to execute arbitrary code by constructing a malicious workspace with a crafted sourcekit-lsp.serverPath, swift.languageServerPath, swift.path.sourcekite, swift.path.sourcekiteDockerMode, swift.path.swift_driver_bin, or swift.path.shell configuration value that triggers execution upon opening the workspace.

Ссылки

https://github.com/vknabel/vscode-swift-development-environment/releases/tag/2.12.1
Release Notes
Third Party Advisory
https://vuln.ryotak.me/advisories/14
Third Party Advisory
https://github.com/vknabel/vscode-swift-development-environment/releases/tag/2.12.1
Release Notes
Third Party Advisory
https://vuln.ryotak.me/advisories/14
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:swift_development_environment_project:swift_development_environment:*:*:*:*:*:visual_studio_code:*:*

Версия до 2.12.1 (исключая)

EPSS

Процентиль: 80%

0.0143

Низкий

7.8 High

CVSS3

6.8 Medium

CVSS2

Дефекты

NVD-CWE-noinfo

Связанные уязвимости

GHSA-f4r2-649g-9gv5

github

больше 3 лет назад