NuGet Package Manager Tampering Vulnerability
Date: 2022-05
Affected: nuget/NuGet.Commands
Attack vector: other
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2019-0976
CWE: CWE-732
CVSS: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)

A tampering vulnerability exists in the NuGet Package Manager for Linux and Mac that could allow an authenticated attacker to modify contents of the intermediate build folder (by default `obj`), aka 'NuGet Package Manager Tampering Vulnerability'.


Mitigations:

Architectural layers (MAESTRO):