CVE-2024-43488

Missing authentication for critical function in Visual Studio Code extension for Arduino allows an unauthenticated attacker to perform remote code execution through network attack vector.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43488	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:microsoft:visual_studio_code:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2024-10-08 18:15

Updated : 2024-10-21 21:05

NVD link : CVE-2024-43488

Mitre link : CVE-2024-43488

CVE.ORG link : CVE-2024-43488

JSON object : View

Products Affected

microsoft

visual_studio_code

CWE

CWE-306

Missing Authentication for Critical Function

NVD-CWE-noinfo

{"id": "CVE-2024-43488", "cveTags": [{"tags": ["exclusively-hosted-service"], "sourceIdentifier": "secure@microsoft.com"}], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "secure@microsoft.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2024-10-08T18:15:11.030", "references": [{"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43488", "tags": ["Patch", "Vendor Advisory"], "source": "secure@microsoft.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "secure@microsoft.com", "description": [{"lang": "en", "value": "CWE-306"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "Missing authentication for critical function in Visual Studio Code extension for Arduino allows an unauthenticated attacker to perform remote code execution through network attack vector."}, {"lang": "es", "value": "La falta de autenticaci\u00f3n para una funci\u00f3n cr\u00edtica en la extensi\u00f3n de Visual Studio Code para Arduino permite que un atacante no autenticado realice una ejecuci\u00f3n remota de c\u00f3digo a trav\u00e9s del vector de ataque de red."}], "lastModified": "2024-10-21T21:05:53.340", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:visual_studio_code:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8FF33086-D7CC-44D1-A347-9F3EB50F74A0"}], "operator": "OR"}]}], "sourceIdentifier": "secure@microsoft.com"}