Home > Vulnerability Database > CVE-2022-41032

Mend.io Vulnerability Database

New vulnerability? Tell us about it!

CVE-2022-41032

Good to know:

Date: October 10, 2022

NuGet Client Elevation of Privilege Vulnerability

Language: C#

Severity Score

7.8

Related Resources (19)

Url: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X7BMHO5ITRBZREVTEKHQRGSFRPDMALV3

Url: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FOG35Z5RL5W5RGLLYLN46CI4D2UPDSWM

Url: https://github.com/NuGet/Announcements/issues/65

Url: https://nvd.nist.gov/vuln/detail/CVE-2022-41032

Url: https://github.com/NuGet/NuGet.Client

Url: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HDPT2MJC3HD7HYZGASOOX6MTDR4ASBL5

Url: https://access.redhat.com/security/cve/CVE-2022-41032

Url: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HDPT2MJC3HD7HYZGASOOX6MTDR4ASBL5/

Url: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X7BMHO5ITRBZREVTEKHQRGSFRPDMALV3/

Url: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-41032

Url: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FOG35Z5RL5W5RGLLYLN46CI4D2UPDSWM

Url: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X7BMHO5ITRBZREVTEKHQRGSFRPDMALV3

Url: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HDPT2MJC3HD7HYZGASOOX6MTDR4ASBL5

Url: https://github.com/NuGet/NuGet.Client/security/advisories/GHSA-g3q9-xf95-8hp5

Url: https://github.com/NuGet/NuGet.Client/commit/6392863cf83f4870e18f1d02f2463cca633e59ed

Url: https://www.edwardthomson.com/blog/my-first-cve.html

Url: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FOG35Z5RL5W5RGLLYLN46CI4D2UPDSWM/

Url: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41032

Url: https://www.mend.io/vulnerability-database/CVE-2022-41032

Severity Score

7.8

Weakness Type (CWE)

Insufficient Information

NVD-CWE-noinfo

Improper Privilege Management

CWE-269

Top Fix

Upgrade Version

Upgrade to version NuGet.Commands - 5.11.3;NuGet.Commands - 6.2.2;NuGet.Commands - 6.3.1;NuGet.Commands - 4.9.6;NuGet.Commands - 5.9.3;NuGet.CommandLine - 6.2.2;NuGet.CommandLine - 6.3.1;NuGet.CommandLine - 5.9.3;NuGet.CommandLine - 5.11.3;NuGet.CommandLine - 4.9.6;NuGet.Protocol - 5.11.3;NuGet.Protocol - 6.3.1;NuGet.Protocol - 6.2.2;NuGet.Protocol - 4.9.6;NuGet.Protocol - 5.9.3

CVSS v3.1

Base Score:	7.8
Attack Vector (AV):	LOCAL
Attack Complexity (AC):	LOW
Privileges Required (PR):	LOW
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	HIGH
Integrity (I):	HIGH
Availability (A):	HIGH

Do you need more information?

Contact Us