What’s Vulnerable › Vulnerabilities

CVE-2019-0757

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-04-09 · updated 2026-06-17

Description

A tampering vulnerability exists in the NuGet Package Manager for Linux and Mac that could allow an authenticated attacker to modify a NuGet package's folder structure, aka 'NuGet Package Manager Tampering Vulnerability'.

Affected products

• Microsoft .NET Core SDK: 1.1, 2.1.500, 2.2.100
• Microsoft Nuget: 4.3.1, 4.4.2, 4.5.2, 4.6.3, 4.7.2, 4.8.2 (+1)
• Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8): all versions
• Mono-Project Mono Framework: 5.18.0.223, 5.20.0
• Red Hat Enterprise Linux: 8.0
• RedHat Enterprise Linux Eus: 8.1, 8.2, 8.4
• RedHat Enterprise Linux Server Aus: 8.2, 8.4
• RedHat Enterprise Linux Server Tus: 8.2, 8.4
• Microsoft .NET Core SDK: 1.1 on .NET Core 1.0, 2.1.500 on .NET Core 2.1, 2.2.100 on .NET Core 2.2, 1.1 on .NET Core 1.1
• Microsoft Mono Framework: 5.18.0.223, 5.20.0
• Microsoft Nuget: 4.3.1, 4.4.2, 4.5.2, 4.6.3, 4.7.2, 4.8.2 (+1)
• Microsoft Visual Studio: 2017 for Mac

References

• https://access.redhat.com/errata/RHSA-2019:1259
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0757
• https://access.redhat.com/errata/RHSA-2019:1259
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0757

Get alerted when CVE-2019-0757 or the next vulnerability affects your stack