Skip to content
OpenAdvisories
High MSRC-CVE-2022-41032 1 CVE

NuGet Client Elevation of Privilege Vulnerability

Published Oct 11, 2022 · Updated Oct 11, 2022

Summary

Impact: Elevation of Privilege. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

Are any other products affected by this vulnerability?
Yes. See the following list of affected versions of NuGet.exe, NuGet.Commands, NuGet.CommandLine, and NuGet.Protocol. Customers using any of these affected versions please see <Link to NuGet advisory> for information about how to fix the vulnerability.
Any NuGet.exe, NuGet.Commands, NuGet.CommandLine, NuGet.Protocol 6.3.0 version or earlier, Any NuGet.exe, NuGet.Commands, NuGet.CommandLine, NuGet.Protocol 6.2.1 version or earlier, Any NuGet.exe, NuGet.Commands, NuGet.CommandLine, NuGet.Protocol 6.0.2 version or earlier, Any NuGet.exe, NuGet.Commands, NuGet.CommandLine, NuGet.Protocol 5.11.2 version or earlier, Any NuGet.exe, NuGet.Commands, NuGet.CommandLine, NuGet.Protocol 5.9.2 version or earlier, Any NuGet.exe, NuGet.Commands, NuGet.CommandLine, NuGet.Protocol 5.7.2 version or earlier, Any NuGet.exe, NuGet.Commands, NuGet.CommandLine, NuGet.Protocol 4.9.5 version or earlier

What privileges could be gained by an attacker who successfully exploited the vulnerability?
The attacker would gain the rights of the user that is running the affected application.

Security updates
6.0.10 — https://support.microsoft.com/help/5019351
3.1.30 — https://support.microsoft.com/help/5019349
17.2.9 — https://docs.microsoft.com/en-us/visualstudio/releases/2022/release-notes
16.11.20 — https://docs.microsoft.com/en-us/visualstudio/releases/2019/release-notes-v16.11
16.9.26 — https://docs.microsoft.com/en-us/visualstudio/releases/2019/release-notes-v16.9
17.0.15 — https://docs.microsoft.com/en-us/visualstudio/releases/2022/release-notes-v17.0
17.3.7 — https://docs.microsoft.com/en-us/visualstudio/releases/2022/mac-release-notes

Vulnerabilities 1

Revision history

  1. #1

    Information published.

References