Lucene search

MitreCVE-2021-28790

HistoryMar 18, 2021 - 4:15 p.m.

CVE-2021-28790

2021-03-1816:15:14

mitre

web.nvd.nist.gov

cve-2021-28790

swiftlint

visual studio code

remote code execution

security vulnerability

nvd

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.002

Percentile

60.2%

JSON

The unofficial SwiftLint extension before 1.4.5 for Visual Studio Code allows remote attackers to execute arbitrary code by constructing a malicious workspace with a crafted swiftlint.path configuration value that triggers execution upon opening the workspace.

Affected configurations

Nvd

Node

swiftlint_projectswiftlintRange<1.4.5visual_studio_code

VendorProductVersionCPE
swiftlint_projectswiftlint*cpe:2.3:a:swiftlint_project:swiftlint:*:*:*:*:*:visual_studio_code:*:*

Vendor	Product	Version	CPE
swiftlint_project	swiftlint	*	cpe:2.3:a:swiftlint_project:swiftlint::::::visual_studio_code::*

References

github.com/vknabel/vscode-swiftlint/releases/tag/1.4.5

vuln.ryotak.me/advisories/12

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.002

Percentile

60.2%

JSON

Related for CVE-2021-28790