CVE Vulnerability

CVE-2021-21420

vscode-stripe is an extension for Visual Studio Code. A vulnerability in Stripe for Visual Studio Code extension exists when it loads an untrusted source-code repository containing malicious settings. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. The update addresses the vulnerability by modifying the way the extension validates its settings.

6.8 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 8.6 / Impact : 6.4

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

Scope

7.8 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/stripe/vscode-stripe/security/advisories/GHSA-j6x4-4622-8vv3 Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:stripe:stripe:*:*:*:*:*:visual_studio_code:*:*
Information

Published : 2021-04-01 10:15

Updated : 2022-08-12 06:02

NVD link : CVE-2021-21420

Mitre link : CVE-2021-21420

Products Affected
No products.
CWE
NVD-CWE-noinfo