CVE-2019-0657

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

A vulnerability exists in certain .Net Framework API's and Visual Studio in the way they parse URL's, aka '.NET Framework and Visual Studio Spoofing Vulnerability'.

Metrics

CVSS 3.0 5.9/10CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-20

Affected software

VendorProductVersions
MicrosoftMicrosoft .NET Framework 4.5.2Windows 7 for 32-bit Systems Service Pack 1; Windows 7 for x64-based Systems Service Pack 1; Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation); Windows Server 2008 R2 for x64-based Systems Service Pack 1; Windows Server 2012; Windows Server 2012 (Server Core installation); Windows 8.1 for 32-bit systems; Windows 8.1 for x64-based systems; Windows Server 2012 R2; Windows RT 8.1; Windows Server 2012 R2 (Server Core installation); Windows Server 2008 for 32-bit Systems Service Pack 2; Windows Server 2008 for x64-based Systems Service Pack 2
MicrosoftMicrosoft .NET Framework 4.6Windows Server 2008 for 32-bit Systems Service Pack 2; Windows Server 2008 for x64-based Systems Service Pack 2
Microsoft.NET Core1; 2.1; 2.2
MicrosoftMicrosoft Visual Studio2017
MicrosoftMicrosoft .NET Framework 4.7.2Windows 10 Version 1803 for 32-bit Systems; Windows 10 Version 1803 for x64-based Systems; Windows Server, version 1803 (Server Core Installation); Windows 10 Version 1803 for ARM64-based Systems; Windows 10 Version 1809 for 32-bit Systems; Windows 10 Version 1809 for x64-based Systems; Windows Server 2019; Windows Server 2019 (Server Core installation)
MicrosoftMicrosoft .NET Framework 4.6/4.6.1/4.6.2Windows 10 for 32-bit Systems; Windows 10 for x64-based Systems
MicrosoftMicrosoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2Windows 7 for 32-bit Systems Service Pack 1; Windows 7 for x64-based Systems Service Pack 1; Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation); Windows Server 2008 R2 for x64-based Systems Service Pack 1; Windows Server 2012; Windows Server 2012 (Server Core installation); Windows 8.1 for 32-bit systems; Windows 8.1 for x64-based systems; Windows Server 2012 R2; Windows RT 8.1; Windows Server 2012 R2 (Server Core installation)
MicrosoftMicrosoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2Windows Server 2016; Windows 10 Version 1607 for 32-bit Systems; Windows 10 Version 1607 for x64-based Systems; Windows Server 2016 (Server Core installation)
MicrosoftMicrosoft .NET Framework 4.7/4.7.1/4.7.2Windows 10 Version 1703 for 32-bit Systems; Windows 10 Version 1703 for x64-based Systems
MicrosoftMicrosoft .NET Framework 4.7.1/4.7.2Windows 10 Version 1709 for 32-bit Systems; Windows 10 Version 1709 for x64-based Systems; Windows Server, version 1709 (Server Core Installation); Windows 10 Version 1709 for ARM64-based Systems
MicrosoftPowerShell Core6.1; 6.2
MicrosoftMicrosoft Visual Studio 2017version 15.9
MicrosoftMicrosoft .NET Framework 3.5Windows Server 2012; Windows Server 2012 (Server Core installation); Windows 8.1 for 32-bit systems; Windows 8.1 for x64-based systems; Windows Server 2012 R2; Windows Server 2012 R2 (Server Core installation); Windows 10 for 32-bit Systems; Windows 10 for x64-based Systems; Windows Server 2016; Windows 10 Version 1607 for 32-bit Systems; Windows 10 Version 1607 for x64-based Systems; Windows 10 Version 1703 for 32-bit Systems; Windows 10 Version 1703 for x64-based Systems; Windows 10 Version 1709 for 32-bit Systems; Windows 10 Version 1709 for x64-based Systems; Windows Server, version 1709 (Server Core Installation); Windows 10 Version 1803 for 32-bit Systems; Windows 10 Version 1803 for x64-based Systems; Windows Server, version 1803 (Server Core Installation); Windows 10 Version 1803 for ARM64-based Systems
MicrosoftMicrosoft .NET Framework 3.0Service Pack 2 on Windows Server 2008 for Itanium-Based Systems Service Pack 2; Service Pack 2 on Windows Server 2008 for 32-bit Systems Service Pack 2; Service Pack 2 on Windows Server 2008 for x64-based Systems Service Pack 2
MicrosoftMicrosoft .NET Framework 2.0Service Pack 2 on Windows Server 2008 for Itanium-Based Systems Service Pack 2
MicrosoftMicrosoft .NET Framework 3.5.1Windows 7 for 32-bit Systems Service Pack 1; Windows 7 for x64-based Systems Service Pack 1; Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation); Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1; Windows Server 2008 R2 for x64-based Systems Service Pack 1

References

Timeline

Published
Mar 5, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-06586.5An information disclosure vulnerability exists when the scripting engine does not properly handle objects in memory in Microsoft Edge, aka 'CVE-2019-06597.0An elevation of privilege vulnerability exists when the Storage Service improperly handles file operations, aka 'Windows Storage Service EleCVE-2019-06606.5An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows CVE-2019-06615.5An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel InformationCVE-2019-06628.8A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka CVE-2019-06635.5An information disclosure vulnerability exists when the Windows kernel improperly initializes objects in memory.To exploit this vulnerabilitCVE-2019-06646.5An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows CVE-2019-06657.5A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'Windows VBScript Engine RemCVE-2019-06667.5A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'Windows VBScript Engine RemCVE-2019-06677.5A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'Windows VBScript Engine RemCVE-2019-06688.8An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request tCVE-2019-06696.5An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory, aka 'Microsoft Excel In
CVE-2019-0657: Medium severity, CVSS 5.9 | Vulnix