CVE-2021-31204: .net from 5.0 (inclusive), through 5.0.5 (inclusive); +9 more affected products

Affected technology

.net · from 5.0 (inclusive), through 5.0.5 (inclusive)
microsoft

.net core · from 3.1 (inclusive), through 3.1.14 (inclusive)
microsoft

visual studio 2019 · from 16.0 (inclusive), before 16.4.22 (exclusive)
microsoft

visual studio 2019 · from 16.5.0 (inclusive), before 16.7.15 (exclusive)
microsoft

visual studio 2019 · from 16.8.0 (inclusive), before 16.9.5 (exclusive)
microsoft

visual studio 2019 · 8.9
microsoft

fedora · 32
fedoraproject

fedora · 33
fedoraproject

fedora · 34
fedoraproject

.NET Core 3.1 · 3.1 to before 3.1.15-servicing.21214.3
Microsoft

.NET 5.0 · 5.0.0 to before 5.0.6-servicing.21220.11
Microsoft

Microsoft Visual Studio 2019 version 16.9 (includes 16.0 - 16.8) · 15.0.0 to before publication
Microsoft

Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3) · 16.0 to before publication
Microsoft

Microsoft Visual Studio 2019 version 16.7 (includes 16.0 – 16.6) · 16.0.0 to before publication
Microsoft

Visual Studio 2019 for Mac version 8.9 · 8.0 to before publication
Microsoft

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Local · Low privileges required · User interaction required

Attack conditions (NVD, CVSS 3.1): Local · Low privileges required · No user interaction required

What an attacker can do

Vendor/CNA’s CVSS 3.1 assessment (base score 7.3/10) rates confidentiality, integrity and availability impact as high. NVD’s CVSS 3.1 assessment (base score 7.8/10) rates confidentiality, integrity and availability impact as high. The description does not specify what an attacker can achieve beyond these rated impacts.