Summary
Impact: Elevation of Privilege. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.
Details
Are any other products affected by this vulnerability?
Yes. See the following list of affected versions of NuGet.exe, NuGet.Commands, NuGet.CommandLine, and NuGet.Protocol. Customers using any of these affected versions please see <Link to NuGet advisory> for information about how to fix the vulnerability.
Any NuGet.exe, NuGet.Commands, NuGet.CommandLine, NuGet.Protocol 6.3.0 version or earlier, Any NuGet.exe, NuGet.Commands, NuGet.CommandLine, NuGet.Protocol 6.2.1 version or earlier, Any NuGet.exe, NuGet.Commands, NuGet.CommandLine, NuGet.Protocol 6.0.2 version or earlier, Any NuGet.exe, NuGet.Commands, NuGet.CommandLine, NuGet.Protocol 5.11.2 version or earlier, Any NuGet.exe, NuGet.Commands, NuGet.CommandLine, NuGet.Protocol 5.9.2 version or earlier, Any NuGet.exe, NuGet.Commands, NuGet.CommandLine, NuGet.Protocol 5.7.2 version or earlier, Any NuGet.exe, NuGet.Commands, NuGet.CommandLine, NuGet.Protocol 4.9.5 version or earlier
What privileges could be gained by an attacker who successfully exploited the vulnerability?
The attacker would gain the rights of the user that is running the affected application.
Security updates
6.0.10 — https://support.microsoft.com/help/5019351
3.1.30 — https://support.microsoft.com/help/5019349
17.2.9 — https://docs.microsoft.com/en-us/visualstudio/releases/2022/release-notes
16.11.20 — https://docs.microsoft.com/en-us/visualstudio/releases/2019/release-notes-v16.11
16.9.26 — https://docs.microsoft.com/en-us/visualstudio/releases/2019/release-notes-v16.9
17.0.15 — https://docs.microsoft.com/en-us/visualstudio/releases/2022/release-notes-v17.0
17.3.7 — https://docs.microsoft.com/en-us/visualstudio/releases/2022/mac-release-notes
Vulnerabilities 1
-
High 7.8CVE-2022-41032 Public exploit
NuGet Client Elevation of Privilege Vulnerability
NuGet Client Elevation of Privilege Vulnerability
Revision history
-
#1
Information published.
References
-
CVE-2022-41032 NuGet Client Elevation of Privilege Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41032
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss