CVE-2022-41032

NuGet Client Elevation of Privilege Vulnerability

Description

NuGet Client Elevation of Privilege Vulnerability

Link	Tags
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41032	vendor advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FOG35Z5RL5W5RGLLYLN46CI4D2UPDSWM/	third party advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HDPT2MJC3HD7HYZGASOOX6MTDR4ASBL5/	third party advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X7BMHO5ITRBZREVTEKHQRGSFRPDMALV3/	third party advisory
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-41032	patch vendor advisory

What is the severity of CVE-2022-41032?: CVE-2022-41032 has been scored as a high severity vulnerability.
How to fix CVE-2022-41032?: To fix CVE-2022-41032, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2022-41032 being actively exploited in the wild?: It is possible that CVE-2022-41032 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~14% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2022-41032?: CVE-2022-41032 affects Microsoft .NET 6.0, Microsoft .NET Core 3.1, Microsoft Microsoft Visual Studio 2022 version 17.2, Microsoft Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10), Microsoft Microsoft Visual Studio 2019 version 16.9 (includes 16.0 - 16.8), Microsoft Microsoft Visual Studio 2022 version 17.0, Microsoft Microsoft Visual Studio 2022 version 17.3, Microsoft Visual Studio 2022 for Mac version 17.3.