Description
NuGet Client Elevation of Privilege Vulnerability
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Microsoft | .NET 6.0 | 6.0.0 – < 6.0.10 | 6.0.10 |
| Microsoft | .NET Core 3.1 | 3.1 – < 3.1.30 | 3.1.30 |
| Microsoft | Microsoft Visual Studio 2022 version 17.2 | 17.2.0 – < 17.2.9 | 17.2.9 |
| Microsoft | Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10) | 16.11.0 – < 16.11.20 | 16.11.20 |
| Microsoft | Microsoft Visual Studio 2019 version 16.9 (includes 16.0 - 16.8) | 15.0.0 – < 16.9.26 | 16.9.26 |
| Microsoft | Microsoft Visual Studio 2022 version 17.0 | 17.0.0 – < 17.0.15 | 17.0.15 |
| Microsoft | Microsoft Visual Studio 2022 version 17.3 | 17.0.0 – < 17.3.6 | 17.3.6 |
| Microsoft | Visual Studio 2022 for Mac version 17.3 | 17.3 – < 17.3.7 | 17.3.7 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | dotnet6 | 6.0.110-0ubuntu1~22.04.1 | USN-5670-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | dotnet-host +6 | 6.0.10-1.el9_0 | RHSA-2022:8434, RHSA-2022:6913 |
| RHEL 9 | dotnet-hostfxr-7.0 +5 | 7.0.0-0.5.rc2.el9_1 | RHSA-2022:8434 |
| RHEL 9 | dotnet6.0 +4 | 6.0.110-1.el9_0 | RHSA-2022:8434, RHSA-2022:6913 |
| RHEL 9 | dotnet7.0 +3 | 7.0.100-0.5.rc2.el9_1 | RHSA-2022:8434 |
| RHEL 8 | dotnet +5 | 6.0.110-1.el8_6 | RHSA-2022:7826, RHSA-2022:6911 |
| RHEL 8 | dotnet-host +6 | 6.0.10-1.el8_6 | RHSA-2022:7826, RHSA-2022:6911 |
| RHEL 8 | dotnet-hostfxr-3.1 +5 | 3.1.30-1.el8_6 | RHSA-2022:6912 |
| RHEL 8 | dotnet-hostfxr-7.0 +5 | 7.0.0-0.4.rc2.el8_7 | RHSA-2022:7826 |
| RHEL 8 | dotnet3.1 +3 | 3.1.424-1.el8_6 | RHSA-2022:6912 |
| RHEL 8 | dotnet7.0 +3 | 7.0.100-0.4.rc2.el8_7 | RHSA-2022:7826 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Dotnet 6 | rh-dotnet60-dotnet +4 | 6.0.110-1.el7_9 | RHSA-2022:6915 |
| Red Hat Rhel Dotnet 6 | rh-dotnet60-dotnet-host +6 | 6.0.10-1.el7_9 | RHSA-2022:6915 |
| Red Hat Rhel Dotnet 3 | rh-dotnet31-dotnet +4 | 3.1.424-1.el7_9 | RHSA-2022:6914 |
| Red Hat Rhel Dotnet 3 | rh-dotnet31-dotnet-host +6 | 3.1.30-1.el7_9 | RHSA-2022:6914 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | dotnet-host +6 | 6.0.10-1.el9_0 | ALSA-2022:8434, ALSA-2022:6913 |
| AlmaLinux 9 | dotnet-hostfxr-7.0 +5 | 7.0.0-0.5.rc2.el9_1 | ALSA-2022:8434 |
| AlmaLinux 9 | dotnet-sdk-6.0 +3 | 6.0.110-1.el9_0 | ALSA-2022:8434, ALSA-2022:6913 |
| AlmaLinux 9 | dotnet-sdk-7.0 +2 | 7.0.100-0.5.rc2.el9_1 | ALSA-2022:8434 |
| AlmaLinux 8 | dotnet +4 | 6.0.110-1.el8_6 | ALSA-2022:7826, ALSA-2022:6911 |
| AlmaLinux 8 | dotnet-host +6 | 6.0.10-1.el8_6 | ALSA-2022:7826, ALSA-2022:6911 |
| AlmaLinux 8 | dotnet-hostfxr-3.1 +5 | 3.1.30-1.el8_6 | ALSA-2022:6912 |
| AlmaLinux 8 | dotnet-hostfxr-7.0 +5 | 7.0.0-0.4.rc2.el8_7 | ALSA-2022:7826 |
| AlmaLinux 8 | dotnet-sdk-3.1 +2 | 3.1.424-1.el8_6 | ALSA-2022:6912 |
| AlmaLinux 8 | dotnet-sdk-7.0 +2 | 7.0.100-0.4.rc2.el8_7 | ALSA-2022:7826 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 9 | dotnet6.0 | 6.0.110-1.el9_0 | RLSA-2022:6913 |
| Rocky Linux 8 | dotnet3.1 | 3.1.424-1.el8_6 | RLSA-2022:6912 |
| Rocky Linux 8 | dotnet6.0 | 6.0.110-1.el8_6 | RLSA-2022:6911 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.20 | dotnet6-build | 6.0.110-r0 | — |
| Alpine v3.20 | dotnet6-runtime | 6.0.10-r0 | — |
| Alpine v3.19 | dotnet6-build | 6.0.110-r0 | — |
| Alpine v3.19 | dotnet6-runtime | 6.0.10-r0 | — |
| Alpine v3.18 | dotnet6-build | 6.0.110-r0 | — |
| Alpine v3.18 | dotnet6-runtime | 6.0.10-r0 | — |
| Alpine v3.17 | dotnet6-build | 6.0.110-r0 | — |
| Alpine v3.17 | dotnet6-runtime | 6.0.10-r0 | — |
| Alpine v3.16 | dotnet6-build | 6.0.110-r0 | — |
| Alpine v3.16 | dotnet6-runtime | 6.0.10-r0 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | dotnet-host +6 | 6.0.10-1.0.1.el9_0 | ELSA-2022-8434, ELSA-2022-6913 |
| Oracle Linux 9 | dotnet-hostfxr-7.0 +5 | 7.0.0-0.5.rc2.0.1.el9_1 | ELSA-2022-8434 |
| Oracle Linux 9 | dotnet-sdk-6.0 +3 | 6.0.110-1.0.1.el9_0 | ELSA-2022-8434, ELSA-2022-6913 |
| Oracle Linux 9 | dotnet-sdk-7.0 +2 | 7.0.100-0.5.rc2.0.1.el9_1 | ELSA-2022-8434 |
| Oracle Linux 8 | dotnet +4 | 6.0.110-1.0.1.el8_6 | ELSA-2022-7826, ELSA-2022-6911 |
| Oracle Linux 8 | dotnet-host +6 | 6.0.10-1.0.1.el8_6 | ELSA-2022-7826, ELSA-2022-6911 |
| Oracle Linux 8 | dotnet-hostfxr-3.1 +5 | 3.1.30-1.0.1.el8_6 | ELSA-2022-6912 |
| Oracle Linux 8 | dotnet-hostfxr-7.0 +5 | 7.0.0-0.4.rc2.0.1.el8_7 | ELSA-2022-7826 |
| Oracle Linux 8 | dotnet-sdk-3.1 +2 | 3.1.424-1.0.1.el8_6 | ELSA-2022-6912 |
| Oracle Linux 8 | dotnet-sdk-7.0 +2 | 7.0.100-0.4.rc2.0.1.el8_7 | ELSA-2022-7826 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 1 repository
-
ethomson/cve-2022-41032 ★ 1 · Jun 10, 2022
Reproduction / example repository for CVE 2022-41032.
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| NuGet | NuGet.CommandLine | >= 4.6.0, < 4.9.6 | 4.9.6 | GHSA-g3q9-xf95-8hp5 |
| NuGet | NuGet.CommandLine | >= 5.0.0, < 5.7.3 | 5.7.3 | GHSA-g3q9-xf95-8hp5 |
| NuGet | NuGet.CommandLine | >= 5.8.0, < 5.9.3 | 5.9.3 | GHSA-g3q9-xf95-8hp5 |
| NuGet | NuGet.CommandLine | >= 5.10.0, < 5.11.3 | 5.11.3 | GHSA-g3q9-xf95-8hp5 |
| NuGet | NuGet.CommandLine | >= 6.0.0, < 6.0.3 | 6.0.3 | GHSA-g3q9-xf95-8hp5 |
| NuGet | NuGet.CommandLine | >= 6.1.0, < 6.2.2 | 6.2.2 | GHSA-g3q9-xf95-8hp5 |
| NuGet | NuGet.CommandLine | >= 6.3.0, < 6.3.1 | 6.3.1 | GHSA-g3q9-xf95-8hp5 |
| NuGet | NuGet.Commands | >= 4.6.0, < 4.9.6 | 4.9.6 | GHSA-g3q9-xf95-8hp5 |
| NuGet | NuGet.Commands | >= 5.0.0, < 5.7.3 | 5.7.3 | GHSA-g3q9-xf95-8hp5 |
| NuGet | NuGet.Commands | >= 5.8.0, < 5.9.3 | 5.9.3 | GHSA-g3q9-xf95-8hp5 |
| NuGet | NuGet.Commands | >= 5.10.0, < 5.11.3 | 5.11.3 | GHSA-g3q9-xf95-8hp5 |
| NuGet | NuGet.Commands | >= 6.0.0, < 6.0.3 | 6.0.3 | GHSA-g3q9-xf95-8hp5 |
| NuGet | NuGet.Commands | >= 6.1.0, < 6.2.2 | 6.2.2 | GHSA-g3q9-xf95-8hp5 |
| NuGet | NuGet.Commands | >= 6.3.0, < 6.3.1 | 6.3.1 | GHSA-g3q9-xf95-8hp5 |
| NuGet | NuGet.Protocol | >= 4.6.0, < 4.9.6 | 4.9.6 | GHSA-g3q9-xf95-8hp5 |
| NuGet | NuGet.Protocol | >= 5.0.0, < 5.7.3 | 5.7.3 | GHSA-g3q9-xf95-8hp5 |
| NuGet | NuGet.Protocol | >= 5.8.0, < 5.9.3 | 5.9.3 | GHSA-g3q9-xf95-8hp5 |
| NuGet | NuGet.Protocol | >= 5.10.0, < 5.11.3 | 5.11.3 | GHSA-g3q9-xf95-8hp5 |
| NuGet | NuGet.Protocol | >= 6.0.0, < 6.0.3 | 6.0.3 | GHSA-g3q9-xf95-8hp5 |
| NuGet | NuGet.Protocol | >= 6.1.0, < 6.2.2 | 6.2.2 | GHSA-g3q9-xf95-8hp5 |
| NuGet | NuGet.Protocol | >= 6.3.0, < 6.3.1 | 6.3.1 | GHSA-g3q9-xf95-8hp5 |
Advisories 25
- ALSA-2022:6913 Moderate: .NET 6.0 security and bugfix update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2022:8434 Moderate: dotnet7.0 security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2022:7826 Moderate: dotnet7.0 security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2022:6911 Moderate: .NET 6.0 security and bugfix update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2022:6912 Moderate: .NET Core 3.1 security and bugfix update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2022:7826 Red Hat Security Advisory: dotnet7.0 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2022:8434 Red Hat Security Advisory: dotnet7.0 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2022:6911 Red Hat Security Advisory: .NET 6.0 security and bugfix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2022:6913 Red Hat Security Advisory: .NET 6.0 security and bugfix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2022:6912 Red Hat Security Advisory: .NET Core 3.1 security and bugfix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- USN-5670-1 dotnet6 vulnerability Ubuntu Security Notices (USN) · Feb 10, 2026
- RLSA-2022:6913 Moderate: .NET 6.0 security and bugfix update Rocky Linux Security Advisories · Feb 5, 2026
- RLSA-2022:6912 Moderate: .NET Core 3.1 security and bugfix update Rocky Linux Security Advisories · Feb 4, 2026
- RLSA-2022:6911 Moderate: .NET 6.0 security and bugfix update Rocky Linux Security Advisories · Feb 4, 2026
- RHSA-2022:6915 Red Hat Security Advisory: .NET 6.0 on RHEL 7 security and bugfix update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2022:6914 Red Hat Security Advisory: .NET Core 3.1 on RHEL 7 security and bugfix update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- ICSA-23-320-12 Siemens PNI CISA ICS & IT advisories · Nov 14, 2023
- SSA-150063 SSA-150063: Multiple Vulnerabilities in SINEC PNI before V2.0 Siemens ProductCERT · Nov 14, 2023
- WID-SEC-2022-1683 Microsoft Developer Tools: Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 4, 2022
- ELSA-2022-8434 Moderate: dotnet7.0 security, bug fix, and enhancement update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Nov 29, 2022
- ELSA-2022-7826 Moderate: dotnet7.0 security, bug fix, and enhancement update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Nov 17, 2022
- ELSA-2022-6911 Moderate: .NET 6.0 security and bugfix update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Oct 13, 2022
- ELSA-2022-6913 Moderate: .NET 6.0 security and bugfix update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Oct 13, 2022
- ELSA-2022-6912 Moderate: .NET Core 3.1 security and bugfix update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Oct 12, 2022
- MSRC-CVE-2022-41032 NuGet Client Elevation of Privilege Vulnerability Microsoft Security Response Center · Oct 11, 2022
References
- NuGet Client Elevation of Privilege Vulnerability vendor-advisory