Search for vulnerabilities
Vulnerability details: VCID-2xft-a45k-aaaa
Vulnerability ID VCID-2xft-a45k-aaaa
Aliases CVE-2019-0976
GHSA-3hcm-6fjc-47qq
Summary A tampering vulnerability exists in the NuGet Package Manager for Linux and Mac that could allow an authenticated attacker to modify contents of the intermediate build folder (by default "obj"), aka 'NuGet Package Manager Tampering Vulnerability'.
Status Published
Exploitability 0.5
Weighted Severity 9.0
Risk 4.5
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-732 Incorrect Permission Assignment for Critical Resource
System Score Found at
epss 0.00046 https://api.first.org/data/v1/epss?cve=CVE-2019-0976
epss 0.00046 https://api.first.org/data/v1/epss?cve=CVE-2019-0976
epss 0.00046 https://api.first.org/data/v1/epss?cve=CVE-2019-0976
epss 0.00046 https://api.first.org/data/v1/epss?cve=CVE-2019-0976
epss 0.00046 https://api.first.org/data/v1/epss?cve=CVE-2019-0976
epss 0.00046 https://api.first.org/data/v1/epss?cve=CVE-2019-0976
epss 0.00046 https://api.first.org/data/v1/epss?cve=CVE-2019-0976
epss 0.00046 https://api.first.org/data/v1/epss?cve=CVE-2019-0976
epss 0.00046 https://api.first.org/data/v1/epss?cve=CVE-2019-0976
epss 0.00046 https://api.first.org/data/v1/epss?cve=CVE-2019-0976
epss 0.00046 https://api.first.org/data/v1/epss?cve=CVE-2019-0976
epss 0.00046 https://api.first.org/data/v1/epss?cve=CVE-2019-0976
epss 0.00046 https://api.first.org/data/v1/epss?cve=CVE-2019-0976
epss 0.00046 https://api.first.org/data/v1/epss?cve=CVE-2019-0976
epss 0.00046 https://api.first.org/data/v1/epss?cve=CVE-2019-0976
epss 0.00054 https://api.first.org/data/v1/epss?cve=CVE-2019-0976
epss 0.00274 https://api.first.org/data/v1/epss?cve=CVE-2019-0976
epss 0.00274 https://api.first.org/data/v1/epss?cve=CVE-2019-0976
epss 0.00274 https://api.first.org/data/v1/epss?cve=CVE-2019-0976
epss 0.00274 https://api.first.org/data/v1/epss?cve=CVE-2019-0976
epss 0.00274 https://api.first.org/data/v1/epss?cve=CVE-2019-0976
epss 0.00274 https://api.first.org/data/v1/epss?cve=CVE-2019-0976
epss 0.00274 https://api.first.org/data/v1/epss?cve=CVE-2019-0976
epss 0.00274 https://api.first.org/data/v1/epss?cve=CVE-2019-0976
epss 0.00274 https://api.first.org/data/v1/epss?cve=CVE-2019-0976
epss 0.00274 https://api.first.org/data/v1/epss?cve=CVE-2019-0976
epss 0.00274 https://api.first.org/data/v1/epss?cve=CVE-2019-0976
epss 0.00274 https://api.first.org/data/v1/epss?cve=CVE-2019-0976
epss 0.00274 https://api.first.org/data/v1/epss?cve=CVE-2019-0976
epss 0.00274 https://api.first.org/data/v1/epss?cve=CVE-2019-0976
epss 0.00274 https://api.first.org/data/v1/epss?cve=CVE-2019-0976
epss 0.00274 https://api.first.org/data/v1/epss?cve=CVE-2019-0976
epss 0.00274 https://api.first.org/data/v1/epss?cve=CVE-2019-0976
epss 0.00274 https://api.first.org/data/v1/epss?cve=CVE-2019-0976
epss 0.00274 https://api.first.org/data/v1/epss?cve=CVE-2019-0976
epss 0.00274 https://api.first.org/data/v1/epss?cve=CVE-2019-0976
epss 0.00274 https://api.first.org/data/v1/epss?cve=CVE-2019-0976
epss 0.00274 https://api.first.org/data/v1/epss?cve=CVE-2019-0976
epss 0.00274 https://api.first.org/data/v1/epss?cve=CVE-2019-0976
epss 0.00274 https://api.first.org/data/v1/epss?cve=CVE-2019-0976
epss 0.00274 https://api.first.org/data/v1/epss?cve=CVE-2019-0976
epss 0.00274 https://api.first.org/data/v1/epss?cve=CVE-2019-0976
epss 0.00274 https://api.first.org/data/v1/epss?cve=CVE-2019-0976
epss 0.00274 https://api.first.org/data/v1/epss?cve=CVE-2019-0976
epss 0.00274 https://api.first.org/data/v1/epss?cve=CVE-2019-0976
epss 0.00274 https://api.first.org/data/v1/epss?cve=CVE-2019-0976
epss 0.00274 https://api.first.org/data/v1/epss?cve=CVE-2019-0976
epss 0.00274 https://api.first.org/data/v1/epss?cve=CVE-2019-0976
epss 0.00274 https://api.first.org/data/v1/epss?cve=CVE-2019-0976
epss 0.00274 https://api.first.org/data/v1/epss?cve=CVE-2019-0976
epss 0.00274 https://api.first.org/data/v1/epss?cve=CVE-2019-0976
epss 0.00274 https://api.first.org/data/v1/epss?cve=CVE-2019-0976
epss 0.00274 https://api.first.org/data/v1/epss?cve=CVE-2019-0976
epss 0.00274 https://api.first.org/data/v1/epss?cve=CVE-2019-0976
epss 0.00274 https://api.first.org/data/v1/epss?cve=CVE-2019-0976
epss 0.00274 https://api.first.org/data/v1/epss?cve=CVE-2019-0976
epss 0.00274 https://api.first.org/data/v1/epss?cve=CVE-2019-0976
epss 0.00274 https://api.first.org/data/v1/epss?cve=CVE-2019-0976
epss 0.00274 https://api.first.org/data/v1/epss?cve=CVE-2019-0976
epss 0.00274 https://api.first.org/data/v1/epss?cve=CVE-2019-0976
epss 0.00274 https://api.first.org/data/v1/epss?cve=CVE-2019-0976
epss 0.00274 https://api.first.org/data/v1/epss?cve=CVE-2019-0976
epss 0.00274 https://api.first.org/data/v1/epss?cve=CVE-2019-0976
epss 0.00274 https://api.first.org/data/v1/epss?cve=CVE-2019-0976
epss 0.00274 https://api.first.org/data/v1/epss?cve=CVE-2019-0976
epss 0.00329 https://api.first.org/data/v1/epss?cve=CVE-2019-0976
epss 0.00329 https://api.first.org/data/v1/epss?cve=CVE-2019-0976
epss 0.00336 https://api.first.org/data/v1/epss?cve=CVE-2019-0976
epss 0.00336 https://api.first.org/data/v1/epss?cve=CVE-2019-0976
epss 0.00336 https://api.first.org/data/v1/epss?cve=CVE-2019-0976
epss 0.00336 https://api.first.org/data/v1/epss?cve=CVE-2019-0976
epss 0.00336 https://api.first.org/data/v1/epss?cve=CVE-2019-0976
epss 0.00336 https://api.first.org/data/v1/epss?cve=CVE-2019-0976
epss 0.00336 https://api.first.org/data/v1/epss?cve=CVE-2019-0976
epss 0.00336 https://api.first.org/data/v1/epss?cve=CVE-2019-0976
epss 0.00336 https://api.first.org/data/v1/epss?cve=CVE-2019-0976
epss 0.00336 https://api.first.org/data/v1/epss?cve=CVE-2019-0976
epss 0.00336 https://api.first.org/data/v1/epss?cve=CVE-2019-0976
epss 0.00336 https://api.first.org/data/v1/epss?cve=CVE-2019-0976
epss 0.00336 https://api.first.org/data/v1/epss?cve=CVE-2019-0976
epss 0.00336 https://api.first.org/data/v1/epss?cve=CVE-2019-0976
epss 0.00336 https://api.first.org/data/v1/epss?cve=CVE-2019-0976
epss 0.00336 https://api.first.org/data/v1/epss?cve=CVE-2019-0976
epss 0.00336 https://api.first.org/data/v1/epss?cve=CVE-2019-0976
epss 0.00336 https://api.first.org/data/v1/epss?cve=CVE-2019-0976
epss 0.00438 https://api.first.org/data/v1/epss?cve=CVE-2019-0976
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-3hcm-6fjc-47qq
cvssv3.1 5.5 https://github.com/NuGet/Home/issues/7908
generic_textual MODERATE https://github.com/NuGet/Home/issues/7908
cvssv3.1 9.1 https://github.com/NuGet/NuGet.Client
generic_textual CRITICAL https://github.com/NuGet/NuGet.Client
cvssv3.1 5.5 https://github.com/NuGet/NuGet.Client/commit/e32a2ea7096debd3e513188f6779bb1041593326
generic_textual MODERATE https://github.com/NuGet/NuGet.Client/commit/e32a2ea7096debd3e513188f6779bb1041593326
cvssv2 2.1 https://nvd.nist.gov/vuln/detail/CVE-2019-0976
cvssv3 5.5 https://nvd.nist.gov/vuln/detail/CVE-2019-0976
cvssv3.1 5.5 https://nvd.nist.gov/vuln/detail/CVE-2019-0976
cvssv3.1 5.5 https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0976
generic_textual MODERATE https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0976
cvssv3.1 5.5 https://web.archive.org/web/20200227075944/http://www.securityfocus.com/bid/108210
generic_textual MODERATE https://web.archive.org/web/20200227075944/http://www.securityfocus.com/bid/108210
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2019-0976
https://github.com/NuGet/Home/issues/7908
https://github.com/NuGet/NuGet.Client
https://github.com/NuGet/NuGet.Client/commit/e32a2ea7096debd3e513188f6779bb1041593326
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0976
https://web.archive.org/web/20200227075944/http://www.securityfocus.com/bid/108210
http://www.securityfocus.com/bid/108210
CVE-2019-0976 https://nvd.nist.gov/vuln/detail/CVE-2019-0976
GHSA-3hcm-6fjc-47qq https://github.com/advisories/GHSA-3hcm-6fjc-47qq
No exploits are available.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Found at https://github.com/NuGet/Home/issues/7908
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Found at https://github.com/NuGet/NuGet.Client
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Found at https://github.com/NuGet/NuGet.Client/commit/e32a2ea7096debd3e513188f6779bb1041593326
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: AV:L/AC:L/Au:N/C:N/I:P/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2019-0976
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2019-0976
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2019-0976
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Found at https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0976
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Found at https://web.archive.org/web/20200227075944/http://www.securityfocus.com/bid/108210
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.17063
EPSS Score 0.00046
Published At Nov. 1, 2024, midnight
Date Actor Action Source VulnerableCode Version
There are no relevant records.