Vulnerability · Published Jun 15, 2022 · Assigned by microsoft
CVE-2022-30184.NET and Visual Studio Information Disclosure Vulnerability
Medium 5.5
In plain English
A medium-severity information exposure in Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10) from Microsoft. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 6.1% (higher than 93% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)6.1%top 6.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
.NET and Visual Studio Information Disclosure Vulnerability
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | dotnet6-build | 6.0.106-r0 | ALPINE-CVE-2022-30184 |
| Alpine:v3.20 | dotnet6-runtime | 6.0.6-r0 | ALPINE-CVE-2022-30184 |
| NuGet | nuget.commandline | 6.2.1 | GHSA-3885-8gqc-3wpf |
| NuGet | nuget.commandline | 5.9.2 | GHSA-3885-8gqc-3wpf |
| NuGet | nuget.commandline | 6.0.2 | GHSA-3885-8gqc-3wpf |
| NuGet | nuget.commandline | 4.9.5 | GHSA-3885-8gqc-3wpf |
| NuGet | nuget.commandline | 5.2.1 | GHSA-3885-8gqc-3wpf |
| NuGet | nuget.commandline | 5.7.2 | GHSA-3885-8gqc-3wpf |
| NuGet | nuget.commandline | 5.11.2 | GHSA-3885-8gqc-3wpf |
| NuGet | nuget.commandline.xplat | 4.9.5 | GHSA-3885-8gqc-3wpf |
| NuGet | nuget.commandline.xplat | 5.7.2 | GHSA-3885-8gqc-3wpf |
| NuGet | nuget.commandline.xplat | 5.2.1 | GHSA-3885-8gqc-3wpf |
| NuGet | nuget.commandline.xplat | 5.9.2 | GHSA-3885-8gqc-3wpf |
| NuGet | nuget.commandline.xplat | 5.11.2 | GHSA-3885-8gqc-3wpf |
| NuGet | nuget.commandline.xplat | 6.2.1 | GHSA-3885-8gqc-3wpf |
| NuGet | nuget.commandline.xplat | 6.0.2 | GHSA-3885-8gqc-3wpf |
| NuGet | nuget.commands | 5.9.2 | GHSA-3885-8gqc-3wpf |
| NuGet | nuget.commands | 5.11.2 | GHSA-3885-8gqc-3wpf |
| NuGet | nuget.commands | 6.0.2 | GHSA-3885-8gqc-3wpf |
| NuGet | nuget.commands | 6.2.1 | GHSA-3885-8gqc-3wpf |
| NuGet | nuget.commands | 4.9.5 | GHSA-3885-8gqc-3wpf |
| NuGet | nuget.commands | 5.2.1 | GHSA-3885-8gqc-3wpf |
| NuGet | nuget.commands | 5.7.2 | GHSA-3885-8gqc-3wpf |
| Rocky Linux:8 | dotnet3.1 | 0:3.1.420-1.el8_6 | RLSA-2022:5061 |
| Rocky Linux:8 | dotnet6.0 | 0:6.0.106-1.el8_6 | RLSA-2022:5046 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Microsoft | .NET 6.0 | 6.0.0 – before 6.0.6 |
| Microsoft | .NET Core 3.1 | 3.1 – before 3.1.26 |
| Microsoft | Microsoft Visual Studio 2019 version 16.9 (includes 16.0 - 16.8) | 15.0.0 – before 16.9.22 |
| Microsoft | Visual Studio 2019 for Mac version 8.10 | 8.1.0 – before 17.0.2 |
| Microsoft | Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10) | 16.11.0 – before 16.11.16 |
| Microsoft | Microsoft Visual Studio 2022 version 17.0 | 17.0.0 – before 17.0.11 |
| Microsoft | Microsoft Visual Studio 2022 version 17.2 | 17.2.0 – before 17.2.4 |
| Microsoft | NuGet.exe | 6.0.0 – before 6.2.0 |
| Microsoft | Visual Studio 2022 for Mac version 17.0 | 17.0.0 – before 17.0.2 |
Weakness: CWE-200 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C
References
- .NET and Visual Studio Information Disclosure Vulnerability vendor-advisory
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-30184 x_refsource_MISC, x_transferred
- FEDORA-2022-cd37732349 vendor-advisory, x_refsource_FEDORA, x_transferred
- FEDORA-2022-5508547b1e vendor-advisory, x_refsource_FEDORA, x_transferred