CVE-2021-41355

{"containers": {"cna": {"title": ".NET Core and Visual Studio Information Disclosure Vulnerability", "datePublic": "2021-10-12T07:00:00.000Z", "affected": [{"vendor": "Microsoft", "product": "PowerShell 7.1", "cpes": ["cpe:2.3:a:microsoft:powershell_core:*:*:*:*:*:*:*:*"], "platforms": ["Unknown"], "versions": [{"version": "7.1.0", "lessThan": "7.1.5", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Visual Studio 2019 version 16.9 (includes 16.0 - 16.8)", "cpes": ["cpe:2.3:a:microsoft:visual_studio_2019:16.9:*:*:*:*:*:*:*"], "platforms": ["Unknown"], "versions": [{"version": "15.0.0", "lessThan": "16.9.12", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10)", "cpes": ["cpe:2.3:a:microsoft:visual_studio_2019:*:*:*:*:*:*:*:*"], "platforms": ["Unknown"], "versions": [{"version": "16.11.0", "lessThan": "16.11.5", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": ".NET 5.0", "cpes": ["cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*"], "platforms": ["Unknown"], "versions": [{"version": "5.0.0", "lessThan": "5.0.11", "versionType": "custom", "status": "affected"}]}], "descriptions": [{"value": ".NET Core and Visual Studio Information Disclosure Vulnerability", "lang": "en-US"}], "problemTypes": [{"descriptions": [{"description": "Information Disclosure", "lang": "en-US", "type": "Impact"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2024-05-29T14:52:18.055Z"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41355"}, {"tags": ["x_refsource_MISC"], "url": "https://www.oracle.com/security-alerts/cpujan2022.html"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "baseSeverity": "MEDIUM", "baseScore": 5.7, "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C"}}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T03:08:32.217Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41355"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.oracle.com/security-alerts/cpujan2022.html"}]}]}, "cveMetadata": {"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "assignerShortName": "microsoft", "cveId": "CVE-2021-41355", "datePublished": "2021-10-13T00:28:19.000Z", "dateReserved": "2021-09-17T00:00:00.000Z", "dateUpdated": "2024-08-04T03:08:32.217Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:microsoft:powershell_core:*:*:*:*:*:*:*:*"], "platforms": ["Unknown"], "product": "PowerShell 7.1", "vendor": "Microsoft", "versions": [{"lessThan": "7.1.5", "status": "affected", "version": "7.1.0", "versionType": "custom"}]}, {"cpes": ["cpe:2.3:a:microsoft:visual_studio_2019:16.9:*:*:*:*:*:*:*"], "platforms": ["Unknown"], "product": "Microsoft Visual Studio 2019 version 16.9 (includes 16.0 - 16.8)", "vendor": "Microsoft", "versions": [{"lessThan": "16.9.12", "status": "affected", "version": "15.0.0", "versionType": "custom"}]}, {"cpes": ["cpe:2.3:a:microsoft:visual_studio_2019:*:*:*:*:*:*:*:*"], "platforms": ["Unknown"], "product": "Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10)", "vendor": "Microsoft", "versions": [{"lessThan": "16.11.5", "status": "affected", "version": "16.11.0", "versionType": "custom"}]}, {"cpes": ["cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*"], "platforms": ["Unknown"], "product": ".NET 5.0", "vendor": "Microsoft", "versions": [{"lessThan": "5.0.11", "status": "affected", "version": "5.0.0", "versionType": "custom"}]}], "source": "secure@microsoft.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:.net:5.0:*:*:*:*:*:*:*", "matchCriteriaId": "C8F02D5C-61F1-4381-8D64-8BEB5CED0DC6", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:powershell:*:*:*:*:*:*:*:*", "matchCriteriaId": "B041049C-2717-41B9-A56F-F080967E5FB9", "versionEndExcluding": "7.1.5", "versionStartIncluding": "7.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:visual_studio_2019:*:*:*:*:*:*:*:*", "matchCriteriaId": "C9984FFB-8AFA-438F-B762-B98649B64B23", "versionEndIncluding": "16.11", "versionStartIncluding": "16.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": ".NET Core and Visual Studio Information Disclosure Vulnerability"}, {"lang": "es", "value": "Una vulnerabilidad de Divulgaci\u00f3n de Informaci\u00f3n en .NET Core y Visual Studio"}], "id": "CVE-2021-41355", "lastModified": "2026-06-17T04:08:24.287", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "ADJACENT_NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 2.9, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:A/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 5.5, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "baseScore": 5.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 3.6, "source": "secure@microsoft.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "baseScore": 5.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Secondary"}]}, "published": "2021-10-13T01:15:13.907", "references": [{"source": "secure@microsoft.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41355"}, {"source": "secure@microsoft.com", "tags": ["Not Applicable", "Third Party Advisory"], "url": "https://www.oracle.com/security-alerts/cpujan2022.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41355"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Not Applicable", "Third Party Advisory"], "url": "https://www.oracle.com/security-alerts/cpujan2022.html"}], "sourceIdentifier": "secure@microsoft.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2021:3818", "cpe": "cpe:/a:redhat:rhel_dotnet:5.0::el7", "package": "rh-dotnet50-dotnet-0:5.0.208-1.el7_9", "product_name": ".NET Core on Red Hat Enterprise Linux", "release_date": "2021-10-12T00:00:00Z"}, {"advisory": "RHSA-2021:3819", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "dotnet5.0-0:5.0.208-1.el8_4", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2021-10-12T00:00:00Z"}], "bugzilla": {"description": "dotnet: System.DirectoryServices.Protocols.LdapConnection sends credentials in plaintext if TLS handshake fails", "id": "2011487", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2011487"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.7", "cvss3_scoring_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "status": "verified"}, "cwe": "CWE-319", "details": [".NET Core and Visual Studio Information Disclosure Vulnerability", "A flaw was found in dotnet, where the System.DirectoryServices.Protocols.LdapConnection sends credentials in plaintext if the Transport Layer Security (TLS) handshake fails. This flaw allows an attacker to intercept sensitive information. The highest threat from this vulnerability is to confidentiality."], "name": "CVE-2021-41355", "package_state": [{"cpe": "cpe:/a:redhat:rhel_dotnet:3.1", "fix_state": "Not affected", "package_name": "rh-dotnet31-dotnet", "product_name": ".NET Core 3.1 on Red Hat Enterprise Linux"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "dotnet3.1", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "dotnet3.1", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2021-10-12T17:22:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2021-41355\nhttps://nvd.nist.gov/vuln/detail/CVE-2021-41355\nhttps://github.com/dotnet/announcements/issues/203\nhttps://github.com/dotnet/core/blob/main/release-notes/5.0/5.0.11/5.0.11.md\nhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-41355"], "threat_severity": "Important"}

{}