CVE-2021-43877
ASP.NET Core and Visual Studio Elevation of Privilege Vulnerability
ASP.NET Core and Visual Studio Elevation of Privilege Vulnerability
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
ASP.NET Core and Visual Studio Elevation of Privilege Vulnerability
ASP.NET Core and Visual Studio Elevation of Privilege Vulnerability
- Record
CVE-2021-43877- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C - Updated
- 2026-11-02
EUVDEUVD-2021-30739
ASP.NET Core and Visual Studio Elevation of Privilege Vulnerability
- Record
EUVD-2021-30739- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C - Updated
- 2026-11-03
NVD
ASP.NET Core and Visual Studio Elevation of Privilege Vulnerability
- Record
CVE-2021-43877- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 4.6 Medium
AV:L/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-03
OSV
ASP.NET Core and Visual Studio Elevation of Privilege Vulnerability
- Record
CVE-2021-43877- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-04
OSVBIT-aspnet-core-2021-43877 No score
ASP.NET Core and Visual Studio Elevation of Privilege Vulnerability
ASP.NET Core and Visual Studio Elevation of Privilege Vulnerability
- Record
BIT-aspnet-core-2021-43877- Updated
- 2026-11-02
Affected products
- microsoft asp.net core
- microsoft asp.net core 3.1
- microsoft asp.net core 5.0
- microsoft asp.net core 6.0
- microsoft visual studio 2019 version 16.11 (includes 16.0 - 16.10)
- microsoft visual studio 2019 version 16.7 (includes 16.0 – 16.6)
- microsoft visual studio 2019 version 16.9 (includes 16.0 - 16.8)
- microsoft visual studio 2022 version 17.0
- microsoft visual studio 2022 version 17.1
- microsoft visual studio 2019
- microsoft visual studio 2022
Affected packages
| Package | Affected | Fixed |
|---|---|---|
aspnet-coreBitnami |
3.1.0 up to 3.1.1, 5.0.0 up to 5.0.1, 6.0.0 up to 6.0.1 | 3.1.15.0.16.0.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | OSV | |
| aliases | EUVD, NVD | |
| first indexed | CVE List, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-43877 is a high vulnerability (CVSS 8.8) in Microsoft Asp.net Core, published December 15, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.73%, the 54th percentile. Fixed in aspnet-core 3.1.1.