Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
kasperskyKaspersky LabKLA20040
HistoryNov 08, 2022 - 12:00 a.m.

KLA20040 Multiple vulnerabilities in Microsoft Developer Tools

2022-11-0800:00:00
Kaspersky Lab
threats.kaspersky.com
175

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

7.8 High

AI Score

Confidence

High

4.4 Medium

CVSS2

Access Vector

LOCAL

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:M/Au:N/C:P/I:P/A:P

0.001 Low

EPSS

Percentile

47.6%

JSON

Detect date:

11/08/2022

Severity:

High

Description:

Multiple vulnerabilities were found in Microsoft Developer Tools. Malicious users can exploit these vulnerabilities to gain privileges, obtain sensitive information, execute arbitrary code.

Exploitation:

Public exploits exist for this vulnerability.

Affected products:

Windows Sysmon
Microsoft .NET Framework 4.6.2
Microsoft Visual Studio 2022 version 17.2
Microsoft .NET Framework 4.8
Nuget 2.1.2
Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10)
Microsoft .NET Framework 4.7.2
Nuget 4.8.5
Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)
Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2
Microsoft Visual Studio 2022 version 17.0
Microsoft Visual Studio 2022 version 17.3
Microsoft .NET Framework 4.8.1

Solution:

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Original advisories:

CVE-2022-41120
CVE-2022-41064
CVE-2022-41119
CVE-2022-39253

Impacts:

ACE

Related products:

Microsoft .NET Framework

CVE-IDS:

CVE-2022-411207.8Critical
CVE-2022-410645.8High
CVE-2022-411197.8Critical
CVE-2022-392535.5High

KB list:

5020690
5020687
5020678
5020695
5020691
5020685
5020681
5020801
5020686
5019970
5020694
5020679
5020614
5020622
5020680
5020689
5020688
5019964
5020692

Microsoft official advisories:

References

Related

nessus 64
mscve 4
prion 5
cve 5
mskb 19
github 4
openvas 35
ibm 3
ubuntucve 3
veracode 2
osv 10
wolfi 1
fedora 5
alpinelinux 2
ubuntu 3
debiancve 2
githubexploit 1
redhatcve 2
cgr 1
freebsd 2
altlinux 1
slackware 2
cloudfoundry 1
kaspersky 1
amazon 4
mageia 2
oraclelinux 2
almalinux 2
debian 3
redhat 3
apple 1
photon 2
rosalinux 2
nessus
nessus
Security Updates for Microsoft Visual Studio Products (Nov 2022)
2022-11-10 00:00:00
Microsoft Windows Sysinternals Sysmon < 14.13 Elevation of Privilege (November 2022)
2022-12-13 00:00:00
Security Updates for Microsoft .NET Framework (November 2022)
2022-11-10 00:00:00
mscve
mscve
Visual Studio Remote Code Execution Vulnerability
2022-11-08 08:00:00
Microsoft Windows System Monitor (Sysmon) Elevation of Privilege Vulnerability
2022-11-08 08:00:00
.NET Framework Information Disclosure Vulnerability
2022-11-08 08:00:00
prion
prion
Privilege escalation
2022-11-09 22:15:00
Remote code execution
2022-11-09 22:15:00
Information disclosure
2022-11-09 22:15:00
cve
cve
CVE-2022-41119
2022-11-09 22:15:00
CVE-2022-41120
2022-11-09 22:15:00
CVE-2022-41064
2022-11-09 22:15:00
mskb
mskb
November 8, 2022-KB5020692 Cumulative Update for .NET Framework 3.5, 4.8 and 4.8.1 for Microsoft server operating system version 21H2
2022-11-08 08:00:00
November 8, 2022-Security Only Update for .NET Framework 4.6.2 for Windows Server 2008 SP2 (KB5020681)
2022-11-08 08:00:00
November 8, 2022-Security Only Update for .NET Framework 3.5.1, 4.6.2, 4.7, 4.7.1, 4.7.2, 4.8 for Windows 7 SP1 and Windows Server 2008 R2 SP1 (KB5020678)
2022-11-08 08:00:00
github
github
.NET Information Disclosure Vulnerability
2022-11-08 23:00:22
Container build can leak any path on the host into the container
2022-11-11 00:03:31
Git security vulnerabilities announced
2022-10-18 17:11:45
openvas
openvas
Microsoft .NET Framework Information Disclosure Vulnerability (KB5020689)
2023-02-02 00:00:00
Microsoft .NET Framework Information Disclosure Vulnerability (KB5020690)
2023-02-02 00:00:00
Microsoft .NET Framework Information Disclosure Vulnerability (KB5020688)
2023-02-02 00:00:00
ibm
ibm
Security Bulletin: A vulnerability in Microsoft .NET Framework may affect IBM Robotic Process Automation and result in an exposure of sensitive information (CVE-2022-41064)
2023-03-08 20:18:19
Security Bulletin: A vulnerability in Microsoft .NET Framework may affect IBM Robotic Process Automation and result in an exposure of sensitive information (CVE-2022-41064)
2023-09-11 16:04:21
Security Bulletin: Multiple Security Vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak.
2023-01-30 21:27:00
ubuntucve
ubuntucve
CVE-2022-41064
2022-11-09 00:00:00
CVE-2022-39253
2022-10-18 00:00:00
CVE-2023-22490
2023-02-14 00:00:00
veracode
veracode
Information Disclosure
2022-11-10 13:49:48
Information Disclosure
2022-10-20 19:55:20
osv
osv
.NET Information Disclosure Vulnerability
2022-11-08 23:00:22
Container build can leak any path on the host into the container
2022-11-11 00:03:31
git vulnerability
2023-03-28 19:38:09
wolfi
wolfi
CVE-2022-39253 vulnerabilities
2024-05-04 09:06:25
fedora
fedora
[SECURITY] Fedora 36 Update: moby-engine-20.10.20-1.fc36
2022-10-22 13:52:03
[SECURITY] Fedora 37 Update: moby-engine-20.10.20-1.fc37
2022-11-10 22:49:47
[SECURITY] Fedora 36 Update: git-2.38.1-1.fc36
2022-10-28 11:15:54
alpinelinux
alpinelinux
CVE-2022-39253
2022-10-19 11:15:00
CVE-2023-22490
2023-02-14 20:15:16
ubuntu
ubuntu
Git vulnerability
2023-03-28 00:00:00
Git vulnerabilities
2022-11-21 00:00:00
Git vulnerabilities
2022-10-18 00:00:00
debiancve
debiancve
CVE-2022-39253
2022-10-19 11:15:00
CVE-2023-22490
2023-02-14 20:15:16
githubexploit
githubexploit
Exploit for Link Following in Git-Scm Git
2022-12-20 08:17:05
redhatcve
redhatcve
CVE-2022-39253
2022-10-24 20:49:24
CVE-2023-22490
2023-02-17 15:59:20
cgr
cgr
CVE-2022-39253 vulnerabilities
2024-05-04 09:06:25
freebsd
freebsd
git -- Local clone-based data exfiltration with non-local transports
2023-02-14 00:00:00
git -- Multiple vulnerabilities
2022-06-09 00:00:00
altlinux
altlinux
Security fix for the ALT Linux 10 package git version 2.33.5-alt1
2022-10-22 00:00:00
slackware
slackware
[slackware-security] git
2022-10-18 20:40:51
[slackware-security] git
2023-02-15 19:51:52
cloudfoundry
cloudfoundry
USN-5686-1: Git vulnerabilities | Cloud Foundry
2022-12-07 00:00:00
kaspersky
kaspersky
KLA20184 Multiple vulnerabilities in Git for Windows
2022-10-18 00:00:00
amazon
amazon
Important: git
2022-12-01 17:34:00
Important: git
2022-12-01 20:31:00
Medium: git
2023-03-02 20:22:00
mageia
mageia
Updated git packages fix security vulnerability
2023-02-27 23:27:16
Updated git packages fix security vulnerability
2022-10-28 09:54:08
oraclelinux
oraclelinux
git security and bug fix update
2023-05-23 00:00:00
git security and bug fix update
2023-05-15 00:00:00
almalinux
almalinux
Moderate: git security and bug fix update
2023-05-09 00:00:00
Moderate: git security and bug fix update
2023-05-16 00:00:00
debian
debian
[SECURITY] [DLA 3239-2] git regression update
2022-12-14 18:36:03
[SECURITY] [DLA 3239-1] git security update
2022-12-13 22:36:52
[SECURITY] [DSA 5332-1] git security update
2023-01-29 16:59:53
redhat
redhat
(RHSA-2023:2859) Moderate: git security and bug fix update
2023-05-16 05:56:35
(RHSA-2023:2319) Moderate: git security and bug fix update
2023-05-09 05:07:19
(RHSA-2024:0407) Moderate: git security update
2024-01-24 14:40:19
apple
apple
About the security content of Xcode 14.1
2022-11-01 00:00:00
photon
photon
Important Photon OS Security Update - PHSA-2022-3.0-0486
2022-11-11 00:00:00
Important Photon OS Security Update - PHSA-2022-0538
2022-11-09 00:00:00
rosalinux
rosalinux
Advisory ROSA-SA-2023-2292
2023-11-14 13:25:27
Advisory ROSA-SA-2024-2398
2024-04-11 08:08:00

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

7.8 High

AI Score

Confidence

High

4.4 Medium

CVSS2

Access Vector

LOCAL

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:M/Au:N/C:P/I:P/A:P

0.001 Low

EPSS

Percentile

47.6%

JSON
Related for KLA20040
nessus64mscve4prion5cve5mskb19github4openvas35ibm3ubuntucve3veracode2osv10wolfi1fedora5alpinelinux2ubuntu3debiancve2githubexploit1redhatcve2cgr1freebsd2altlinux1slackware2cloudfoundry1kaspersky1amazon4mageia2oraclelinux2almalinux2debian3redhat3apple1photon2rosalinux2