Vulnerability · Published Nov 9, 2022 · Assigned by microsoft
CVE-2022-41064.NET Framework Information Disclosure Vulnerability
Medium 5.8
In plain English
A medium-severity security flaw in Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 from Microsoft. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 61% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)5.8Medium
Exploit odds (30 days)0.9%top 39.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
.NET Framework Information Disclosure Vulnerability
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| NuGet | microsoft.data.sqlclient | 1.1.4 | GHSA-8g2p-5pqh-5jmc |
| NuGet | microsoft.data.sqlclient | 2.1.2 | GHSA-8g2p-5pqh-5jmc |
| NuGet | system.data.sqlclient | 4.8.5 | GHSA-8g2p-5pqh-5jmc |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Microsoft | Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 | 3.0.0.0 – before 10.0.14393.5501 |
| Microsoft | Microsoft .NET Framework 4.6.2 | 4.7.0 – before 4.7.04005.02 |
| Microsoft | Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 | 4.7.0 – before 4.7.04005.02 |
| Microsoft | Microsoft .NET Framework 4.6/4.6.2 | 10.0.0.0 – before 10.0.10240.19567 |
| Microsoft | Microsoft .NET Framework 4.7.2 | 10.0.0.0 – before 10.0.04005.02 |
| Microsoft | Microsoft .NET Framework 4.8 | 4.8.0 – before 4.8.04584.08 |
| Microsoft | Microsoft .NET Framework 4.8.1 | 4.8.0.0 – before 4.8.09110.07 |
| Microsoft | Nuget 2.1.2 | 1.0.0 – before 2.1.2 |
| Microsoft | Nuget 4.8.5 | 1.0.0 – before 4.8.4 |
References
- .NET Framework Information Disclosure Vulnerability vendor-advisory, patch
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-41064 x_transferred