.NET and Visual Studio Information Disclosure Vulnerability

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2022:5050 advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2022:5061 advisory.

  - .NET and Visual Studio Information Disclosure Vulnerability. (CVE-2022-30184)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2022:5046 advisory.

  - .NET and Visual Studio Information Disclosure Vulnerability. (CVE-2022-30184)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-5050 advisory.

    [6.0.106-1.0.1]
    - Add missing Oracle RIDs
    - Build all packages on source-build even when in servicing

    [6.0.106-1]
    - Update to .NET SDK 6.0.106 and Runtime 6.0.6
    - Resolves: RHBZ#2093433

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Microsoft Visual Studio Products installed on the remote macOS or Mac OS X host is missing a security update. It is, therefore, affected by the following vulnerabilities:

  - A potential privilege escalation vulnerability. An attacker can exploit this to elevate their privileges.     (CVE-2022-24513)

  - A potetnial Denial Of Service vulnerability. An attacker can exploit this to create a denial of service.     (CVE-2022-23267)

  - An information disclosure vulnerability. An attacker canm exploit this to disclose potentially sensitive     information. (CVE-2022-30184)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-5046 advisory.

    [6.0.106-1.0.1]
    - Add missing Oracle RIDs

    [6.0.106-1]
    - Update to .NET SDK 6.0.106 and Runtime 6.0.6
    - Resolves: RHBZ#2093432

    [6.0.105-1]
    - Update to .NET SDK 6.0.105 and Runtime 6.0.5
    - Resolves: RHBZ#2082267

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Microsoft Visual Studio Products are missing security updates. It is, therefore, affected by multiple vulnerabilities:

  - An elevation of privilege vulnerability. An attacker can exploit this to gain elevated privileges.     (CVE-2022-24513)

  - An information disclosure vulnerability exists in Visual Studio. An unauthenticated, remote attacker can exploit     this to disclose potentially sensitive information. (CVE-2022-30184)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An information disclosure vulnerability exists in .NET core 6.0 < 6.0.6 and .NET Core 3.1 < 3.1.26. An unauthenticated, local attacker can exploit this, to disclose potentially sensitive information.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-5061 advisory.

    [3.1.420-1.0.1]
    - Add missing Oracle Linux Runtime IDs
    - Update to .NET SDK 3.1.417 and Runtime 3.1.23
    - Resolves: RHBZ#2060566

    [3.1.420-1]
    - Update to .NET SDK 3.1.420 and Runtime 3.1.26
    - Resolves: RHBZ#2096319

    [3.1.419-1]
    - Update to .NET SDK 3.1.419 and Runtime 3.1.25
    - Resolves: RHBZ#2081443

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:5061 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 3.1.420 and .NET Runtime 3.1.26.

    Security Fix(es):

    * dotnet: NuGet Credential leak due to loss of control of third party symbol server domain     (CVE-2022-30184)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:5050 advisory.

  - dotnet: NuGet Credential leak due to loss of control of third party symbol server domain (CVE-2022-30184)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:5062 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 3.1.420 and .NET Runtime 3.1.26.

    Security Fix(es):

    * dotnet: NuGet Credential leak due to loss of control of third party symbol server domain     (CVE-2022-30184)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:5046 advisory.

  - dotnet: NuGet Credential leak due to loss of control of third party symbol server domain (CVE-2022-30184)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:5047 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 6.0.106 and .NET Runtime 6.0.6.

    Security Fix(es):

    * dotnet: NuGet Credential leak due to loss of control of third party symbol server domain     (CVE-2022-30184)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
167655	AlmaLinux 9 : .NET 6.0 (ALSA-2022:5050)	Nessus	Alma Linux Local Security Checks	medium
162851	Rocky Linux 8 : .NET Core 3.1 (RLSA-2022:5061)	Nessus	Rocky Linux Local Security Checks	medium
162848	Rocky Linux 8 : .NET 6.0 (RLSA-2022:5046)	Nessus	Rocky Linux Local Security Checks	medium
162792	Oracle Linux 9 : .NET / 6.0 (ELSA-2022-5050)	Nessus	Oracle Linux Local Security Checks	medium
162392	Security Updates for Visual Studio 2019/2022 (June 2022) (macOS)	Nessus	Windows : Microsoft Bulletins	high
162332	Oracle Linux 8 : .NET / 6.0 (ELSA-2022-5046)	Nessus	Oracle Linux Local Security Checks	medium
162317	Security Updates for Microsoft Visual Studio Products (June 2022)	Nessus	Windows : Microsoft Bulletins	high
162314	Security Updates for Microsoft .NET core (June 2022)	Nessus	Windows	medium
162307	Oracle Linux 8 : .NET / Core / 3.1 (ELSA-2022-5061)	Nessus	Oracle Linux Local Security Checks	medium
162305	RHEL 8 : .NET Core 3.1 (RHSA-2022:5061)	Nessus	Red Hat Local Security Checks	medium
162304	RHEL 9 : .NET 6.0 (RHSA-2022:5050)	Nessus	Red Hat Local Security Checks	medium
162302	RHEL 7 : .NET Core 3.1 on RHEL 7 (RHSA-2022:5062)	Nessus	Red Hat Local Security Checks	medium
162231	RHEL 8 : .NET 6.0 (RHSA-2022:5046)	Nessus	Red Hat Local Security Checks	medium
162229	RHEL 7 : .NET 6.0 on RHEL 7 (RHSA-2022:5047)	Nessus	Red Hat Local Security Checks	medium

Detections

Analytics

CVE-2022-30184

medium

Tenable Plugins

medium

medium

medium

medium

high

medium

high

medium

medium

medium

medium

medium

medium

medium