CVE-2022-41032: NuGet Client Elevation of Privilege Vulnerability

Overview

Severity
High (CVSS 7.8)
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Category
Elevation of Privilege
Exploit Status
Not Exploited
Exploitation Likelihood
Less Likely
Patch Tuesday
2022-Oct
Released
2022-10-11
EPSS Score
18.30% (percentile: 95.2%)

FAQ

Are any other products affected by this vulnerability? Yes. See the following list of affected versions of NuGet.exe, NuGet.Commands, NuGet.CommandLine, and NuGet.Protocol. Customers using any of these affected versions please see <Link to NuGet advisory> for information about how to fix the vulnerability. Any NuGet.exe, NuGet.Commands, NuGet.CommandLine, NuGet.Protocol 6.3.0 version or earlier Any NuGet.exe, NuGet.Commands, NuGet.CommandLine, NuGet.Protocol 6.2.1 version or earlier Any NuGet.exe, NuGet.Commands, NuGet.CommandLine, NuGet.Protocol 6.0.2 version or earlier Any NuGet.exe, NuGet.Commands, NuGet.CommandLine, NuGet.Protocol 5.11.2 version or earlier Any NuGet.exe, NuGet.Commands, NuGet.CommandLine, NuGet.Protocol 5.9.2 version or earlier Any NuGet.exe, NuGet.Commands, NuGet.CommandLine, NuGet.Protocol 5.7.2 version or earlier Any NuGet.exe, NuGet.Commands, NuGet.CommandLine, NuGet.Protocol 4.9.5 version or earlier What privileges could be gained by an attacker who successfully exploited the vulnerability? The attacker would gain the rights of the user that is running the affected application.

Detection & Weaponization (1 sources)

Maturity: Exploit

  • GitHub PoC: 1 repositories

Affected Products (8)

Developer Tools

  • .NET 6.0
  • .NET Core 3.1
  • Microsoft Visual Studio 2022 version 17.2
  • Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10)
  • Microsoft Visual Studio 2019 version 16.9 (includes 16.0 - 16.8)
  • Microsoft Visual Studio 2022 version 17.0
  • Microsoft Visual Studio 2022 version 17.3
  • Visual Studio 2022 for Mac version 17.3

Security Updates (8)

Acknowledgments

<a href="https://twitter.com/ethomson">Edward Thomson</a>

Revision History

  • 2022-10-11: Information published.