CVE-2025-29803 - Vulnerability Details - OpenCVE

Uncontrolled search path element in Visual Studio Tools for Applications and SQL Server Management Studio allows an authorized attacker to elevate privileges locally.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

No data.

No data.

No data.

References

Link	Providers
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-29803

History

Mon, 14 Apr 2025 17:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Sat, 12 Apr 2025 02:15:00 +0000

Type	Values Removed	Values Added
Description		Uncontrolled search path element in Visual Studio Tools for Applications and SQL Server Management Studio allows an authorized attacker to elevate privileges locally.
Title		Visual Studio Tools for Applications and SQL Server Management Studio Elevation of Privilege Vulnerability
Weaknesses		CWE-427
References		https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-29803
Metrics		cvssV3_1 `{'score': 7.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C'}`

MITRE

Status: PUBLISHED

Assigner: microsoft

Published: 2025-04-12T01:32:36.336Z

Updated: 2025-04-16T00:42:12.062Z

Reserved: 2025-03-11T18:19:40.248Z

Link: CVE-2025-29803

Vulnrichment

Updated: 2025-04-14T16:36:44.882Z

NVD

Status : Awaiting Analysis

Published: 2025-04-12T02:15:20.990

Modified: 2025-04-15T18:39:43.697

Link: CVE-2025-29803

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-29803", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "state": "PUBLISHED", "assignerShortName": "microsoft", "dateReserved": "2025-03-11T18:19:40.248Z", "datePublished": "2025-04-12T01:32:36.336Z", "dateUpdated": "2025-04-16T00:42:12.062Z"}, "containers": {"cna": {"title": "Visual Studio Tools for Applications and SQL Server Management Studio Elevation of Privilege Vulnerability", "datePublic": "2025-04-08T07:00:00.000Z", "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:visual_studio_tools_for_applications:*:*:*:*:*:*:*:*", "versionStartIncluding": "16.0", "versionEndExcluding": "16.0.35907.0"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:visual_studio_tools_for_applications:*:*:*:*:*:*:*:*", "versionStartIncluding": "17.0", "versionEndExcluding": "17.0.35906.0"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:.vsta_sdk:*:*:*:*:*:*:*:*", "versionStartIncluding": "17.0", "versionEndExcluding": "17.0.35906.0"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:.vsta_sdk:*:*:*:*:*:*:*:*", "versionStartIncluding": "16.0", "versionEndExcluding": "16.0.35907.0"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:sql_server_management_studio:*:*:*:*:*:*:*:*", "versionStartIncluding": "20.0", "versionEndExcluding": "20.2.37.0"}]}]}], "affected": [{"vendor": "Microsoft", "product": "Visual Studio Tools for Applications (VSTA)", "platforms": ["Unknown"], "versions": [{"version": "16.0", "lessThan": "16.0.35907.0", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Visual Studio Tools for Applications (VSTA)", "platforms": ["Unknown"], "versions": [{"version": "17.0", "lessThan": "17.0.35906.0", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "VSTA 2022 SDK", "platforms": ["Unknown"], "versions": [{"version": "17.0", "lessThan": "17.0.35906.0", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "VSTA 2019 SDK", "platforms": ["Unknown"], "versions": [{"version": "16.0", "lessThan": "16.0.35907.0", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "SQL Server Management Studio 20.2", "platforms": ["Unknown"], "versions": [{"version": "20.0", "lessThan": "20.2.37.0", "versionType": "custom", "status": "affected"}]}], "descriptions": [{"value": "Uncontrolled search path element in Visual Studio Tools for Applications and SQL Server Management Studio allows an authorized attacker to elevate privileges locally.", "lang": "en-US"}], "problemTypes": [{"descriptions": [{"description": "CWE-427: Uncontrolled Search Path Element", "lang": "en-US", "type": "CWE", "cweId": "CWE-427"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2025-04-16T00:42:12.062Z"}, "references": [{"name": "Visual Studio Tools for Applications and SQL Server Management Studio Elevation of Privilege Vulnerability", "tags": ["vendor-advisory"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-29803"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "baseSeverity": "HIGH", "baseScore": 7.3, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C"}}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-04-14T16:35:49.621551Z", "id": "CVE-2025-29803", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-14T16:38:36.817Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-29803", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-04-14T16:35:49.621551Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-14T16:36:44.882Z"}}], "cna": {"title": "Visual Studio Tools for Applications and SQL Server Management Studio Elevation of Privilege Vulnerability", "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C"}, "scenarios": [{"lang": "en-US", "value": "GENERAL"}]}], "affected": [{"vendor": "Microsoft", "product": "Visual Studio Tools for Applications (VSTA)", "versions": [{"status": "affected", "version": "16.0", "lessThan": "16.0.35907.0", "versionType": "custom"}], "platforms": ["Unknown"]}, {"vendor": "Microsoft", "product": "Visual Studio Tools for Applications (VSTA)", "versions": [{"status": "affected", "version": "17.0", "lessThan": "17.0.35906.0", "versionType": "custom"}], "platforms": ["Unknown"]}, {"vendor": "Microsoft", "product": "VSTA 2022 SDK", "versions": [{"status": "affected", "version": "17.0", "lessThan": "17.0.35906.0", "versionType": "custom"}], "platforms": ["Unknown"]}, {"vendor": "Microsoft", "product": "VSTA 2019 SDK", "versions": [{"status": "affected", "version": "16.0", "lessThan": "16.0.35907.0", "versionType": "custom"}], "platforms": ["Unknown"]}, {"vendor": "Microsoft", "product": "SQL Server Management Studio 20.2", "versions": [{"status": "affected", "version": "20.0", "lessThan": "20.2.37.0", "versionType": "custom"}], "platforms": ["Unknown"]}], "datePublic": "2025-04-08T07:00:00.000Z", "references": [{"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-29803", "name": "Visual Studio Tools for Applications and SQL Server Management Studio Elevation of Privilege Vulnerability", "tags": ["vendor-advisory"]}], "descriptions": [{"lang": "en-US", "value": "Uncontrolled search path element in Visual Studio Tools for Applications and SQL Server Management Studio allows an authorized attacker to elevate privileges locally."}], "problemTypes": [{"descriptions": [{"lang": "en-US", "type": "CWE", "cweId": "CWE-427", "description": "CWE-427: Uncontrolled Search Path Element"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:visual_studio_tools_for_applications:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "16.0.35907.0", "versionStartIncluding": "16.0"}, {"criteria": "cpe:2.3:a:microsoft:visual_studio_tools_for_applications:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "17.0.35906.0", "versionStartIncluding": "17.0"}, {"criteria": "cpe:2.3:a:microsoft:.vsta_sdk:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "17.0.35906.0", "versionStartIncluding": "17.0"}, {"criteria": "cpe:2.3:a:microsoft:.vsta_sdk:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "16.0.35907.0", "versionStartIncluding": "16.0"}, {"criteria": "cpe:2.3:a:microsoft:sql_server_management_studio:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "20.2.37.0", "versionStartIncluding": "20.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2025-04-15T17:40:15.118Z"}}}, "cveMetadata": {"cveId": "CVE-2025-29803", "state": "PUBLISHED", "dateUpdated": "2025-04-15T17:40:15.118Z", "dateReserved": "2025-03-11T18:19:40.248Z", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "datePublished": "2025-04-12T01:32:36.336Z", "assignerShortName": "microsoft"}, "dataVersion": "5.1"}