Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
kasperskyKaspersky LabKLA12535
HistoryMay 10, 2022 - 12:00 a.m.

KLA12535 Multiple vulnerabilities in Microsoft Developer Tools

2022-05-1000:00:00
Kaspersky Lab
threats.kaspersky.com
68

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

8 High

AI Score

Confidence

Low

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.622 Medium

EPSS

Percentile

97.8%

JSON

Detect date:

05/10/2022

Severity:

High

Description:

Multiple vulnerabilities were found in Microsoft Developer Tools. Malicious users can exploit these vulnerabilities to cause denial of service, execute arbitrary code.

Affected products:

.NET Core 3.1
Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10)
.NET 5.0
Microsoft .NET Framework 3.5 AND 4.7.2
Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)
.NET 6.0
Microsoft .NET Framework 4.8
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.5.1
Microsoft Visual Studio 2019 version 16.9 (includes 16.0 - 16.8)
Visual Studio Code
Microsoft .NET Framework 4.6
Microsoft Visual Studio 2022 version 17.0
Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2
Microsoft .NET Framework 3.5
Microsoft Visual Studio 2022 version 17.1
Microsoft .NET Framework 3.5 AND 4.8

Solution:

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Original advisories:

CVE-2022-23267
CVE-2022-30129
CVE-2022-29117
CVE-2022-29148
CVE-2022-30130
CVE-2022-29145

Impacts:

ACE

Related products:

Microsoft .NET Framework

CVE-IDS:

CVE-2022-232677.5Critical
CVE-2022-301298.8Critical
CVE-2022-291177.5Critical
CVE-2022-291487.8Critical
CVE-2022-301303.3Warning
CVE-2022-291457.5Critical

KB list:

5014326
5013840
5013870
5013838
5013872
5014329
5013837
5013839
5013871
5013873
5014330
5021243

Microsoft official advisories:

References

Related

nessus 23
altlinux 7
osv 18
oraclelinux 4
redhat 7
almalinux 3
mskb 18
rocky 3
fedora 3
zdi 1
cnvd 3
cve 6
prion 6
mscve 6
veracode 3
github 3
redhatcve 3
photon 2
ibm 4
rapid7blog 1
thn 1
nessus
nessus
Oracle Linux 8 : .NET / 6.0 (ELSA-2022-2199)
2022-05-19 00:00:00
RHEL 7 : .NET 6.0 on RHEL 7 (RHSA-2022:2195)
2022-05-12 00:00:00
RHEL 7 : .NET Core 3.1 on RHEL 7 (RHSA-2022:2194)
2022-05-13 00:00:00
altlinux
altlinux
Security fix for the ALT Linux 10 package dotnet-bootstrap-5.0 version 5.0.17-alt1
2023-03-18 00:00:00
Security fix for the ALT Linux 10 package dotnet-runtime-5.0 version 5.0.17-alt1
2023-03-18 00:00:00
Security fix for the ALT Linux 10 package dotnet-bootstrap-6.0 version 6.0.7-alt1
2022-08-05 00:00:00
osv
osv
Important: .NET 5.0 security, bug fix, and enhancement update
2022-05-11 13:22:02
Important: .NET 6.0 security, bug fix, and enhancement update
2022-05-11 13:20:34
Important: .NET 6.0 security, bug fix, and enhancement update
2022-05-11 13:20:34
oraclelinux
oraclelinux
.NET 6.0 security, bug fix, and enhancement update
2022-05-19 00:00:00
.NET 6.0 security, bug fix, and enhancement update
2022-06-30 00:00:00
.NET 5.0 security, bug fix, and enhancement update
2022-05-19 00:00:00
redhat
redhat
(RHSA-2022:2196) Important: .NET 5.0 on RHEL 7 security and bugfix update
2022-05-11 13:13:27
(RHSA-2022:2202) Important: .NET Core 3.1 security, bug fix, and enhancement update
2022-05-11 13:24:22
(RHSA-2022:2199) Important: .NET 6.0 security, bug fix, and enhancement update
2022-05-11 13:20:34
almalinux
almalinux
Important: .NET Core 3.1 security, bug fix, and enhancement update
2022-05-11 13:24:22
Important: .NET 6.0 security, bug fix, and enhancement update
2022-05-11 13:20:34
Important: .NET 5.0 security, bug fix, and enhancement update
2022-05-11 13:22:02
mskb
mskb
.NET 5.0 Update: May 10, 2022 (KB5014329)
2022-05-10 08:00:00
.NET Core 3.1 Update: May 10, 2022 (KB5014326)
2022-05-10 08:00:00
.NET 6.0 Update: May 10, 2022 (KB5014330)
2022-05-10 08:00:00
rocky
rocky
.NET Core 3.1 security, bug fix, and enhancement update
2022-05-11 13:24:22
.NET 6.0 security, bug fix, and enhancement update
2022-05-11 13:20:34
.NET 5.0 security, bug fix, and enhancement update
2022-05-11 13:22:02
fedora
fedora
[SECURITY] Fedora 34 Update: dotnet6.0-6.0.105-1.fc34
2022-05-21 01:06:20
[SECURITY] Fedora 35 Update: dotnet6.0-6.0.105-1.fc35
2022-05-21 01:32:22
[SECURITY] Fedora 36 Update: dotnet6.0-6.0.105-1.fc36
2022-05-21 01:32:15
zdi
zdi
Microsoft Visual Studio DDS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
2022-05-10 00:00:00
cnvd
cnvd
Microsoft Visual Studio Remote Code Execution Vulnerability (CNVD-2022-60134)
2022-05-12 00:00:00
Microsoft Visual Studio Code Remote Code Execution Vulnerability (CNVD-2022-60132)
2022-05-12 00:00:00
Microsoft Visual Studio and Microsoft .NET Denial of Service Vulnerability
2022-05-12 00:00:00
cve
cve
CVE-2022-29148
2022-05-10 21:15:00
CVE-2022-30129
2022-05-10 21:15:00
CVE-2022-30130
2022-05-10 21:15:00
prion
prion
Remote code execution
2022-05-10 21:15:00
Denial of service
2022-05-10 21:15:00
Remote code execution
2022-05-10 21:15:00
mscve
mscve
Visual Studio Remote Code Execution Vulnerability
2022-05-10 08:00:00
Visual Studio Code Remote Code Execution Vulnerability
2022-05-10 08:00:00
.NET and Visual Studio Denial of Service Vulnerability
2022-05-10 08:00:00
veracode
veracode
Denial Of Service (DoS)
2022-06-02 20:55:36
Denial Of Service (DoS)
2022-06-02 20:55:49
Denial Of Service (DoS)
2022-06-02 20:55:34
github
github
.NET Denial of Service Vulnerability
2022-08-30 19:32:29
.NET Denial of Service Vulnerability
2022-08-30 19:35:52
.NET Denial of Service Vulnerability
2022-10-21 20:50:24
redhatcve
redhatcve
CVE-2022-29117
2022-05-10 17:27:51
CVE-2022-23267
2022-05-10 17:31:12
CVE-2022-29145
2022-05-10 17:28:32
photon
photon
Important Photon OS Security Update - PHSA-2022-0274
2022-11-03 00:00:00
Important Photon OS Security Update - PHSA-2022-4.0-0274
2022-11-03 00:00:00
ibm
ibm
Security Bulletin: Multiple vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak
2022-08-25 01:57:07
Security Bulletin: A vulnerability in Microsoft ASP.NET affects IBM Robotic Process Automation and may result in a denial of service (CVE-2022-29117)
2023-08-31 14:45:38
Security Bulletin: IBM Robotic Process Automation may be vulnerable to denial of service due to microsoft.owin.security.cookies (CVE-2022-29117)
2022-10-06 04:10:57
rapid7blog
rapid7blog
Patch Tuesday - May 2022
2022-05-10 19:59:20
thn
thn
Microsoft Releases Fix for New Zero-Day with May 2022 Patch Tuesday Updates
2022-05-11 05:29:00

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

8 High

AI Score

Confidence

Low

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.622 Medium

EPSS

Percentile

97.8%

JSON
Related for KLA12535
nessus23altlinux7osv18oraclelinux4redhat7almalinux3mskb18rocky3fedora3zdi1cnvd3cve6prion6mscve6veracode3github3redhatcve3photon2ibm4rapid7blog1thn1