CVE-2022-34716HighCVSS 5.9

.NET Spoofing Vulnerability

Published
August 9, 2022
Last Modified
—

🔗 CVE IDs covered (1)

CVE-2022-34716 →

📋 Description

According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability? Successful exploitation of this vulnerability requires an attacker to successfully execute a blind XXE attack.

According to the CVSS metrics, successful exploitation of this vulnerability could lead to major loss of confidentiality (C:H) but have no effect on integrity (I:N) or on availability (A:N). What does that mean for this vulnerability? Confidentiality is High, if an attacker successfuly exploits this it is information disclosure. While the attacker could read files that shouldn't be exposed, they wouldn't have the ability to modify them in any way (Integrity) or delete them to stop the app or server from functioning (Availability).

🎯 Affected products9

  • .NET 6.0
  • .NET Core 3.1
  • Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)
  • Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10)
  • Microsoft Visual Studio 2019 version 16.9 (includes 16.0 - 16.8)
  • Microsoft Visual Studio 2022 version 17.0
  • Microsoft Visual Studio 2022 version 17.2
  • PowerShell 7.0
  • PowerShell 7.2

✅ Remediation

KBRelease Notes (Security Update) — fixed build 15.9.50 KBRelease Notes (Security Update) — fixed build 17.2.7 KBRelease Notes (Security Update) — fixed build 16.9.24 KBRelease Notes (Security Update) — fixed build 16.11.18 KBRelease Notes (Security Update) — fixed build 17.0.13 KB5016990 (Security Update) — fixed build 6.0.8 KB5016987 (Security Update) — fixed build 3.1.28 KBRelease Notes (Security Update) — fixed build 7.0.12 KBRelease Notes (Security Update) — fixed build 7.2.6

🔗 References (9)