CVE-2021-34485: .net from 5.0 (inclusive), through 5.0.8 (inclusive); +14 more affected products

Affected technology

.net · from 5.0 (inclusive), through 5.0.8 (inclusive)
microsoft

.net core · from 2.1 (inclusive), through 2.1.28 (inclusive)
microsoft

.net core · from 3.1 (inclusive), through 3.1.17 (inclusive)
microsoft

powershell core · from 7.0 (inclusive), before 7.0.7 (exclusive)
microsoft

powershell core · from 7.1 (inclusive), before 7.1.4 (exclusive)
microsoft

visual studio 2017 · from 15.0 (inclusive), through 15.9 (inclusive)
microsoft

visual studio 2019 · from 16.0 (inclusive), through 16.10 (inclusive)
microsoft

.NET 5.0 · 5.0.0 to before 5.0.9
Microsoft

.NET Core 2.1 · 2.1 to before 2.1.30
Microsoft

.NET Core 3.1 · 3.1 to before 3.1.18
Microsoft

Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8) · 15.9.0 to before 15.9.38
Microsoft

Microsoft Visual Studio 2019 version 16.10 (includes 16.0 - 16.9) · 16.10.0 to before 16.10.5
Microsoft

Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3) · 16.0 to before 16.4.25
Microsoft

Microsoft Visual Studio 2019 version 16.7 (includes 16.0 – 16.6) · 16.0.0 to before 16.7.18
Microsoft

Microsoft Visual Studio 2019 version 16.9 (includes 16.0 - 16.8) · 15.0.0 to before 16.9.10
Microsoft

PowerShell 7.0 · 7.0.0 to before 7.0.7
Microsoft

PowerShell 7.1 · 7.1.0 to before 7.1.4
Microsoft

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Local · Low privileges required · User interaction required

Attack conditions (NVD, CVSS 3.1): Local · Low privileges required · No user interaction required

Attack conditions (Source advisory, CVSS 3.1): Local · Low privileges required · User interaction required

What an attacker can do

The source reports that an attacker could access information they should not be able to access. Vendor/CNA’s CVSS 3.1 assessment (base score 5.0/10) rates confidentiality impact as high; integrity and availability impact as none. NVD’s CVSS 3.1 assessment (base score 5.5/10) rates confidentiality impact as high; integrity and availability impact as none. Source advisory’s CVSS 3.1 assessment (base score 5.0/10) rates confidentiality impact as high; integrity and availability impact as none.