CVE-2022-21991
Published: 09 February 2022
Summary
CVE-2022-21991 is a high-severity an unspecified weakness vulnerability in Microsoft Visual Studio Code. Its CVSS base score is 8.1 (High).
Operationally, ranked in the top 9.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2022-21991 is a remote code execution vulnerability in the Visual Studio Code Remote Development Extension. It carries a CVSS 3.1 base score of 8.1 with the vector string AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H and is tracked without an assigned CWE.
An unauthenticated attacker can exploit the flaw over the network without user interaction, although successful exploitation requires high attack complexity. If achieved, the attacker obtains full read, write, and availability impact on the affected system.
Microsoft’s Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21991 supplies the official guidance on available patches and mitigation steps. The associated EPSS score remains flat at 0.0582 with no material increase after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-27145
Vulnerability details
Visual Studio Code Remote Development Extension Remote Code Execution Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.