CVE-2022-41032

NuGet Client Elevation of Privilege Vulnerability

Severity Score

7.8

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Track*

*SSVC

Descriptions

NuGet Client Elevation of Privilege Vulnerability

Una Vulnerabilidad de Elevación de Privilegios en el cliente NuGet

A vulnerability was found in dotnet. This flaw allows an attacker to triage a NuGet cache poisoning on Linux via a world-writable cache directory.

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 7.0.100 RC 2 and .NET Runtime 7.0.0 RC 2.

*Credits: N/A

CVSS Scores

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Local

Attack Complexity

Low

Authentication

Single

Confidentiality

Complete

Integrity

Complete

Availability

Complete

* Common Vulnerability Scoring System

SSVC

Decision:Track*

Exploitation

None

Automatable

Tech. Impact

Total

* Organization's Worst-case Scenario

Timeline

2022-09-19 CVE Reserved
2022-10-11 CVE Published
2023-03-30 First Exploit
2025-02-28 CVE Updated
2025-03-30 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-269: Improper Privilege Management
CWE-524: Use of Cache Containing Sensitive Information

CAPEC

References (8)

URL	Tag	Source
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FOG35Z5RL5W5RGLLYLN46CI4D2UPDSWM	Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HDPT2MJC3HD7HYZGASOOX6MTDR4ASBL5	Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X7BMHO5ITRBZREVTEKHQRGSFRPDMALV3	Third Party Advisory

URL	Date	SRC
https://github.com/ethomson/cve-2022-41032	2023-03-30

URL	Date	SRC
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-41032	2023-12-20

URL	Date	SRC
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41032	2025-02-28
https://access.redhat.com/security/cve/CVE-2022-41032	2022-11-15
https://bugzilla.redhat.com/show_bug.cgi?id=2132614	2022-11-15

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Microsoft Search vendor "Microsoft"		.net Search vendor "Microsoft" for product ".net"				6.0.0 Search vendor "Microsoft" for product ".net" and version "6.0.0"		-		Affected
Microsoft Search vendor "Microsoft"		.net Core Search vendor "Microsoft" for product ".net Core"				3.1 Search vendor "Microsoft" for product ".net Core" and version "3.1"		-		Affected
Microsoft Search vendor "Microsoft"		Visual Studio 2019 Search vendor "Microsoft" for product "Visual Studio 2019"				>= 16.0.0 < 16.9.26 Search vendor "Microsoft" for product "Visual Studio 2019" and version " >= 16.0.0 < 16.9.26"		-		Affected
Microsoft Search vendor "Microsoft"		Visual Studio 2019 Search vendor "Microsoft" for product "Visual Studio 2019"				>= 16.10.0 < 16.11.20 Search vendor "Microsoft" for product "Visual Studio 2019" and version " >= 16.10.0 < 16.11.20"		-		Affected
Microsoft Search vendor "Microsoft"		Visual Studio 2022 Search vendor "Microsoft" for product "Visual Studio 2022"				>= 17.0 < 17.0.15 Search vendor "Microsoft" for product "Visual Studio 2022" and version " >= 17.0 < 17.0.15"		-		Affected
Microsoft Search vendor "Microsoft"		Visual Studio 2022 Search vendor "Microsoft" for product "Visual Studio 2022"				>= 17.2.0 < 17.2.9 Search vendor "Microsoft" for product "Visual Studio 2022" and version " >= 17.2.0 < 17.2.9"		-		Affected
Microsoft Search vendor "Microsoft"		Visual Studio 2022 Search vendor "Microsoft" for product "Visual Studio 2022"				>= 17.3 < 17.3.6 Search vendor "Microsoft" for product "Visual Studio 2022" and version " >= 17.3 < 17.3.6"		-		Affected
Microsoft Search vendor "Microsoft"		Visual Studio 2022 Search vendor "Microsoft" for product "Visual Studio 2022"				>= 17.3 < 17.3.7 Search vendor "Microsoft" for product "Visual Studio 2022" and version " >= 17.3 < 17.3.7"		macos		Affected
Fedoraproject Search vendor "Fedoraproject"		Fedora Search vendor "Fedoraproject" for product "Fedora"				35 Search vendor "Fedoraproject" for product "Fedora" and version "35"		-		Affected
Fedoraproject Search vendor "Fedoraproject"		Fedora Search vendor "Fedoraproject" for product "Fedora"				36 Search vendor "Fedoraproject" for product "Fedora" and version "36"		-		Affected
Fedoraproject Search vendor "Fedoraproject"		Fedora Search vendor "Fedoraproject" for product "Fedora"				37 Search vendor "Fedoraproject" for product "Fedora" and version "37"		-		Affected