Skip to content
OpenAdvisories
High MSRC-CVE-2022-34716 1 CVE

.NET Spoofing Vulnerability

Published Aug 9, 2022 · Updated Apr 11, 2023 · Revision 3

Vendor: Microsoft

Summary

Impact: Spoofing. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?
Successful exploitation of this vulnerability requires an attacker to successfully execute a blind XXE attack.

According to the CVSS metrics, successful exploitation of this vulnerability could lead to major loss of confidentiality (C:H) but have no effect on integrity (I:N) or on availability (A:N). What does that mean for this vulnerability?
Confidentiality is High, if an attacker successfuly exploits this it is information disclosure. While the attacker could read files that shouldn't be exposed, they wouldn't have the ability to modify them in any way (Integrity) or delete them to stop the app or server from functioning (Availability).

Security updates
15.9.50 — https://docs.microsoft.com/en-us/visualstudio/releasenotes/vs2017-relnotes
17.2.7 — https://docs.microsoft.com/en-us/visualstudio/releases/2022/release-notes
16.9.24 — https://docs.microsoft.com/en-us/visualstudio/releases/2019/release-notes-v16.9
16.11.18 — https://docs.microsoft.com/en-us/visualstudio/releases/2019/release-notes-v16.11
17.0.13 — https://docs.microsoft.com/en-us/visualstudio/releases/2022/release-notes-v17.0
6.0.8 — https://support.microsoft.com/help/5016990
3.1.28 — https://support.microsoft.com/help/5016987
7.0.12 — https://github.com/PowerShell/Announcements/issues/33

Vulnerabilities 1

Revision history

  1. #3

    Revised the Security Updates table to include Visual Studio 2017 version 15.9, Visual Studio 2019 version 16.9, Visual Studio 2019 version 16.11, Visual Studio 2022 version 17.0, and Visual Studio 2022 version 17.2 because these versions of Visual Studio are affected by this vulnerability. Customers running these supported versions of Visual Studio should install the August 2022 updates to be protected from this vulnerability. Customers who have already installed the updates do not need to take any further action.

  2. #2

    Revised the Security Updates table to include PowerShell 7.0 and PowerShell 7.2 because these versions of PowerShell 7 are affected by this vulnerability. See [https://github.com/PowerShell/Announcements/issues/33](https://github.com/PowerShell/Announcements/issues/33) for more information.

  3. #1

    Information published.

References