Vulnerability Name:

CVE-2022-30184 (CCN-227713)

Assigned:2022-06-14
Published:2022-06-14
Updated:2022-10-05
Summary:.NET and Visual Studio Information Disclosure Vulnerability.
CVSS v3 Severity:5.5 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
4.8 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): None
Availibility (A): None
5.0 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N)
4.4 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): None
Availibility (A): None
5.0 Medium (REDHAT CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N)
4.4 Medium (REDHAT Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): None
Availibility (A): None
CVSS v2 Severity:4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): None
Availibility (A): None
4.6 Medium (CCN CVSS v2 Vector: AV:L/AC:L/Au:S/C:C/I:N/A:N)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Complete
Integrity (I): None
Availibility (A): None
Vulnerability Type:CWE-noinfo
CWE-212
Vulnerability Consequences:Obtain Information
References:Source: MITRE
Type: CNA
CVE-2022-30184

Source: XF
Type: UNKNOWN
ms-dotnet-cve202230184-info-disc(227713)

Source: FEDORA
Type: Mailing List, Third Party Advisory
FEDORA-2022-5508547b1e

Source: FEDORA
Type: Mailing List, Third Party Advisory
FEDORA-2022-cd37732349

Source: CCN
Type: Microsoft Security TechCenter - June 2022
CVE-2022-30184 - .NET and Visual Studio Information Disclosure Vulnerability

Source: MISC
Type: Patch, Vendor Advisory
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-30184

Source: CCN
Type: IBM Security Bulletin 6615221 (Robotic Process Automation for Cloud Pak)
Multiple Security Vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak

Vulnerable Configuration:Configuration 1:
  • cpe:/a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:* (Version >= 17.0 and < 17.0.4)
  • AND
  • cpe:/o:apple:macos:-:*:*:*:*:*:*:*

    • Configuration 2:
  • cpe:/a:microsoft:.net_core:3.1:-:*:*:*:*:*:*
  • OR cpe:/a:microsoft:visual_studio_2019:8.10:*:*:*:*:macos:*:*
  • OR cpe:/a:microsoft:.net:6.0.0:-:*:*:*:*:*:*
  • OR cpe:/a:microsoft:visual_studio_2019:*:*:*:*:*:*:*:* (Version >= 16.10 and < 16.11.6)
  • OR cpe:/a:microsoft:visual_studio_2019:*:*:*:*:*:*:*:* (Version >= 16.0 and < 16.9.22)
  • OR cpe:/a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:* (Version >= 17.2 and < 17.2.5)
  • OR cpe:/a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:* (Version >= 17.0 and < 17.0.11)
  • OR cpe:/a:microsoft:nuget:*:*:*:*:*:*:*:* (Version < 6.2.1)

    • Configuration 3:
  • cpe:/o:fedoraproject:fedora:35:*:*:*:*:*:*:*
  • OR cpe:/o:fedoraproject:fedora:36:*:*:*:*:*:*:*

    • Configuration RedHat 1:
  • cpe:/a:redhat:enterprise_linux:8:*:*:*:*:*:*:*

    • Configuration RedHat 2:
  • cpe:/a:redhat:enterprise_linux:8::appstream:*:*:*:*:*

    • Configuration RedHat 3:
  • cpe:/a:redhat:enterprise_linux:8::crb:*:*:*:*:*

    • Configuration RedHat 4:
  • cpe:/a:redhat:enterprise_linux:9:*:*:*:*:*:*:*

    • Configuration RedHat 5:
  • cpe:/a:redhat:enterprise_linux:9::appstream:*:*:*:*:*

    • Configuration RedHat 6:
  • cpe:/a:redhat:enterprise_linux:9::crb:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:microsoft:.net_core:3.1:-:*:*:*:*:*:*
  • AND
  • cpe:/a:ibm:robotic_process_automation_for_cloud_pak:21.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:robotic_process_automation_for_cloud_pak:21.0.2:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:com.redhat.rhsa:def:20225046
    P
    		RHSA-2022:5046: .NET 6.0 security and bugfix update (Moderate)
    2022-06-15
    oval:com.redhat.rhsa:def:20225050
    P
    		RHSA-2022:5050: .NET 6.0 security and bugfix update (Moderate)
    2022-06-15
    oval:com.redhat.rhsa:def:20225061
    P
    		RHSA-2022:5061: .NET Core 3.1 security and bugfix update (Moderate)
    2022-06-15
    BACK
    microsoft visual studio 2022 *
    apple macos -
    microsoft .net core 3.1 -
    microsoft visual studio 2019 8.10
    microsoft .net 6.0.0 -
    microsoft visual studio 2019 *
    microsoft visual studio 2019 *
    microsoft visual studio 2022 *
    microsoft visual studio 2022 *
    microsoft nuget *
    fedoraproject fedora 35
    fedoraproject fedora 36
    microsoft .net core 3.1
    ibm robotic process automation for cloud pak 21.0.1
    ibm robotic process automation for cloud pak 21.0.2