CVE-2021-43877: ASP.NET Core and Visual Studio Elevation of Privilege Vulnerability

Severity: medium (CVSS 4.6 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-12-15 · updated 2026-06-17

Description

ASP.NET Core and Visual Studio Elevation of Privilege Vulnerability

Affected products

Microsoft .NET Core: 3.1, 5.0, 6.0
Microsoft Visual Studio 2019: 16.7, 16.9, 16.11
Microsoft Visual Studio 2022 version 17.14: 17.0
Microsoft ASP.NET Core 3.1: from 3.0 before 3.1.22 — fixed in 3.1.22
Microsoft ASP.NET Core 5.0: from 5.0 before 5.0.13 — fixed in 5.0.13
Microsoft ASP.NET Core 6.0: from 6.0 before 6.0.101 — fixed in 6.0.101
Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10): from 16.11.0 before 16.11.8 — fixed in 16.11.8
Microsoft Visual Studio 2019 version 16.7 (includes 16.0 – 16.6): from 16.0.0 before 16.7.23 — fixed in 16.7.23
Microsoft Visual Studio 2019 version 16.9 (includes 16.0 - 16.8): from 15.0.0 before 16.9.15 — fixed in 16.9.15
Microsoft Visual Studio 2022 version 17.0: from 17.0.0 before 17.0.3 — fixed in 17.0.3
Microsoft Visual Studio 2022 version 17.1: from 17.0.0 before 17.1.4 — fixed in 17.1.4

How to fix

Upgrade to a fixed version: Microsoft ASP.NET Core 3.1 3.1.22; Microsoft ASP.NET Core 5.0 5.0.13; Microsoft ASP.NET Core 6.0 6.0.101; Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10) 16.11.8; Microsoft Visual Studio 2019 version 16.7 (includes 16.0 – 16.6) 16.7.23; Microsoft Visual Studio 2019 version 16.9 (includes 16.0 - 16.8) 16.9.15; Microsoft Visual Studio 2022 version 17.0 17.0.3; Microsoft Visual Studio 2022 version 17.1 17.1.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-43877 or the next vulnerability affects your stack