CVE-2022-41089

CWE-94 — Code Injection8 documents7 sources
Severity
7.8HIGH
EPSS
4.5%
top 10.84%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
21
Microsoft .net 6.0Microsoft .net 7.0Microsoft .net Core 3.1+18 more
Timeline
PublishedDec 13
Latest updateDec 14

Description

.NET Framework Remote Code Execution Vulnerability

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages24 packages

▶CVEListV5microsoft/microsoft_.net_framework_3.53.5.0 — 30729.8953
▶CVEListV5microsoft/microsoft_.net_framework_4.84.8.0 — 04590.02
▶CVEListV5microsoft/microsoft_.net_framework_3.5.13.5.0 — 30729.8953
▶CVEListV5microsoft/microsoft_.net_framework_4.6.24.7.0 — 04010.02

Patches

Patch: portal.msrc.microsoft.com ↗

🔴Vulnerability Details

3
OSV
.NET Remote Code Execution Vulnerability↗2022-12-14
▶
GHSA
.NET Remote Code Execution Vulnerability↗2022-12-14
▶
CVEList
.NET Framework Remote Code Execution Vulnerability↗2022-12-13
▶

📋Vendor Advisories

2
Microsoft
.NET Framework Remote Code Execution Vulnerability↗2022-12-13
▶
Red Hat
dotnet: parsing maliciously crafted xps files leads to arbitrary code execution↗2022-12-13
▶

🕵️Threat Intelligence

2
Qualys
The December 2022 Patch Tuesday Security Update Review | Qualys↗2022-12-13
▶
Qualys
The December 2022 Patch Tuesday Security Update Review↗2022-12-13
▶