MSRC-CVE-2024-49049 — Visual Studio Code Remote Extension Elevation of Privilege Vulnerability

Summary

Impact: Elevation of Privilege. Microsoft rating: Moderate. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

According to the CVSS metrics, the attack vector is local (AV:L) and privilege required is low (PR:L). What does that mean for this vulnerability?
An attacker must have local access to the targeted machine and must be able to create folders and performance traces on the machine, with restricted privileges that normal users have by default.

Security updates
0.115.1 — https://github.com/microsoft/vscode-docs/tree/main/remote-release-notes

Vulnerabilities 1

High 7.1

CVE-2024-49049

Visual Studio Code Remote Extension Elevation of Privilege Vulnerability

Visual Studio Code Remote Extension Elevation of Privilege Vulnerability

Microsoft Visual Studio Code Remote - SSH Extension

Nov 12, 2024

Revision history

2024-11-12 #1
Information published.

References

CVE-2024-49049 Visual Studio Code Remote Extension Elevation of Privilege Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49049
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
Common Vulnerability Scoring System
https://www.first.org/cvss