Veracode Vulnerability DatabaseVERACODE:37976Information Disclosure
5.8 Medium
CVSS3
Attack Vector
ADJACENT_NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
1.4 Low
CVSS2
Access Vector
ADJACENT_NETWORK
Access Complexity
HIGH
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:A/AC:H/Au:S/C:P/I:N/A:N
0.0005 Low
EPSS
Percentile
14.9%
System.Data.SqlClient and Microsoft.Data.SqlClient packages in the .NET framework are vulnerable to information disclosure. The vulnerability occurs during heavy load, which lets an attacker access arbitrary data from asynchronously executed queries.
References
github.com/advisories/GHSA-8g2p-5pqh-5jmc
github.com/dotnet/announcements/issues/239
github.com/dotnet/runtime/issues/78042
github.com/dotnet/SqlClient/commit/39aa3022fb98f15a7ae3dea75063eb6f95c2b6a3
github.com/dotnet/SqlClient/commit/ced7ad048ed29307de5040855b24fb6c58a12689
github.com/dotnet/SqlClient/pull/928
github.com/dotnet/SqlClient/pull/959
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-41064
Related
5.8 Medium
CVSS3
Attack Vector
ADJACENT_NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
1.4 Low
CVSS2
Access Vector
ADJACENT_NETWORK
Access Complexity
HIGH
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:A/AC:H/Au:S/C:P/I:N/A:N
0.0005 Low
EPSS
Percentile
14.9%