CVE-2024-43603
Improper Link Resolution Before File Access ('Link Following') (CWE-59)
Summary
A vulnerability in the Visual Studio Collector Service can lead to a denial of service condition. This is classified as an improper link resolution before file access ('link following') issue.
Impact
This vulnerability allows a local attacker with low privileges to cause a denial of service, potentially rendering the Visual Studio Collector Service unavailable. The attack does not require user interaction and has a high impact on availability. However, it does not affect the confidentiality or integrity of the system.
Exploitation
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
Patch
A patch is available. Microsoft has released updates to address this vulnerability across multiple versions of Visual Studio.
Mitigation
1. Update affected Visual Studio installations to the latest patched versions: - Visual Studio 2022: Update to version 17.6.20, 17.8.15, 17.10.8, or 17.11.5 or later. - Visual Studio 2019: Update to version 16.11.41 or later. - Visual Studio 2017: Update to version 15.9.67 or later. - Visual Studio 2015 Update 3: Apply the latest security patch. 2. Implement the principle of least privilege, ensuring that users and processes have only the necessary permissions. 3. Monitor for any suspicious local activities or unexpected service disruptions. 4. Consider implementing additional access controls to limit local access to the Visual Studio Collector Service.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
Timeline
A CVSS base score of 5.5 has been assigned.
Feedly found the first article mentioning CVE-2024-43603. See article
NVD published the first details for CVE-2024-43603
Feedly estimated the CVSS score as MEDIUM
EPSS Score was set to: 0.04% (Percentile: 9.7%)
EPSS Score was set to: 0.05% (Percentile: 19%)