Information disclosure in Visual Studio Code Live Share Extension

1) Cleartext transmission of sensitive information

EUVDB-ID: #VU28926

Risk: Low

CVSSv4.0: 1.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-1343

CWE-ID: CWE-319 - Cleartext Transmission of Sensitive Information

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to software uses insecure communication channel to transmit sensitive information. A remote attacker with ability to intercept network traffic can gain access to sensitive data, such as token in plain text.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Microsoft Visual Studio Code Live Share extension: 1.0 - 1.0.2236

CPE2.3

• cpe:2.3:a:microsoft:microsoft_visual_studio_code_live_share_extension:1.0:*:*:*:*:visual_studio:*:*
• cpe:2.3:a:microsoft:microsoft_visual_studio_code_live_share_extension:1.0.91:*:*:*:*:visual_studio:*:*
• cpe:2.3:a:microsoft:microsoft_visual_studio_code_live_share_extension:1.0.123:*:*:*:*:visual_studio:*:*

External links

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1343

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.