PT-2022-7020 · Microsoft+4 · Net Core+10

Published 2022-06-14 · Updated 2025-01-02 · CVE-2022-30184

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions .NET versions prior to 6.0.6 .NET Core versions prior to 3.1.26 NuGet versions prior to 6.2.1 NuGet.exe versions prior to 6.2.1 NuGet.Commands versions prior to 6.2.1 NuGet.CommandLine versions prior to 6.2.1 NuGet.CommandLine.XPlat versions prior to 6.2.1

Description A vulnerability exists in .NET and .NET Core where a nuget.org API key could leak due to an incorrect comparison with a server URL. This issue is related to the lack of protection for service data. Exploitation of this vulnerability may allow an attacker to gain access to confidential information.

Recommendations For .NET 6.0, download and install Runtime 6.0.6 or SDK 6.0.106 from https://dotnet.microsoft.com/download/dotnet-core/6.0. For .NET Core 3.1, download and install Runtime 3.1.26 or SDK 3.1.420 from https://dotnet.microsoft.com/download/dotnet-core/3.1. For NuGet.exe 6.2.0 or lower, download and install 6.2.1 from https://dist.nuget.org/win-x86-commandline/v6.2.1/nuget.exe. For NuGet.exe 6.0.1 or lower, download and install 6.0.2 from https://dist.nuget.org/win-x86-commandline/v6.0.2/nuget.exe. For NuGet.exe 5.11.1 or lower, download and install 5.11.2 from https://dist.nuget.org/win-x86-commandline/v5.11.2/nuget.exe. For NuGet.exe 5.9.1 or lower, download and install 5.9.2 from https://dist.nuget.org/win-x86-commandline/v5.9.2/nuget.exe. For NuGet.exe 5.7.1 or lower, download and install 5.7.2 from https://dist.nuget.org/win-x86-commandline/v4.7.2/nuget.exe. For NuGet.exe 4.9.4 or lower, download and install 4.9.5 from https://dist.nuget.org/win-x86-commandline/v4.9.5/nuget.exe.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

ALT-PU-2022-2837

ALT-PU-2022-2838

ALT-PU-2022-2851

ALT-PU-2022-2852

ALT-PU-2023-1305

ALT-PU-2023-1306

ALT-PU-2023-1307

ALT-PU-2023-1308

BDU:2023-06585

BIT-DOTNET-2022-30184

BIT-DOTNET-SDK-2022-30184

CESA-2022_5046

CESA-2022_5061

CVE-2022-30184

GHSA-3885-8GQC-3WPF

RHSA-2022:5046

RHSA-2022:5047

RHSA-2022:5050

RHSA-2022:5061

RHSA-2022:5062

RHSA-2022_5046

RHSA-2022_5050

RHSA-2022_5061

RLSA-2022:5046

RLSA-2022:5061

Affected Products

.Net Framework

Net Core

Alt Linux

Centos

Nuget

Nuget.Commandline

Nuget.Commandline.Xplat

Nuget.Commands

Nuget.Exe

Red Hat

Rocky Linux

References · 35

• https://nvd.nist.gov/vuln/detail/CVE-2022-30184 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/7HCV4TQGOTOFHO5ETRKGFKAGYV2YAUVE · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2022-5050.html · Vendor Advisory
• https://osv.dev/vulnerability/RLSA-2022:5061 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/K4K5YL7USOKIR3O2DUKBZMYPWXYPDKXG · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/DMP34G53EA2DBTBLFOAQCDZRRENE2EA2 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-dotnet-sdk-2022-30184 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/2CUL3Z7MEED7RFQZVGQL2MTKSFFZKAAY · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3885-8gqc-3wpf · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DMP34G53EA2DBTBLFOAQCDZRRENE2EA2 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWNH4AC3LFVX35MDRX5OBZDGD2AMH66K · Vendor Advisory
• https://osv.dev/vulnerability/RLSA-2022:5046 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/WL334CKOHA6BQQSYJW365HIWJ4IOE45M · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/JA6F4CDKLI3MALV6UK3P2DR5AGCLTT7Y · Vendor Advisory
• https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-30184 · Vendor Advisory