{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.1.3"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.Data.SqlClient"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.1.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 4.8.4"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "System.Data.SqlClient"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.8.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.Data.SqlClient"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.0.0"
            },
            {
              "fixed": "2.1.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-41064"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": true,
    "github_reviewed_at": "2022-11-08T23:00:22Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "Microsoft is releasing this security advisory to provide information about a vulnerability in .NET, .NET Core and .NET Framework\u0027s System.Data.SqlClient and Microsoft.Data.SqlClient NuGet Packages.\n\nA vulnerability exists in System.Data.SqlClient and Microsoft.Data.SqlClient libraries where a timeout occurring under high load can cause incorrect data to be returned as the result of an asynchronously executed query.\n\n## \u003ca name=\"mitigation-factors\"\u003e\u003c/a\u003eMitigation factors\n\nIf you are not talking to Microsoft SQL Server from your application you are not affected by this vulnerability.\n\n### \u003ca name=\"how-affected\"\u003e\u003c/a\u003eHow do I know if I am affected?\n\n.NET has two types of dependencies: direct and transitive. Direct dependencies are dependencies where you specifically add a package to your project, transitive dependencies occur when you add a package to your project that in turn relies on another package. \n\nFor example, the\u202fMicrosoft.AspNetCore.Mvc\u202fpackage depends on the\u202fMicrosoft.AspNetCore.Mvc.Core\u202fpackage. When you add a dependency on\u202fMicrosoft.AspNetCore.Mvc\u202fin your project, you\u0027re taking a transitive dependency on\u202fMicrosoft.AspNetCore.Mvc.Core. \n \nAny application that has a direct or transitive dependency on the\u202f affected packages listed above are vulnerable.\n\n### \u003ca name=\"how-fix\"\u003e\u003c/a\u003eHow do I fix the issue?\n\n* If you are using System.Data.SqlClient on .NET Framework you must install the November update for .NET Framework\n* If you are using System.Data.SqlClient on .NET Core, .NET 5 or .NET 6 you must update the nuget package to an updated version as listed in the affected packages.\n* If you are using Microsoft.Data.SqlClient, anywhere (.NET Core, .NET 5/6, .NET Framework) and you are using a version that is vulnerable you must update as listed in the affected packages.\n\n**Additional Details**\n\n.NET and .NET Framework projects have two types of dependencies: direct and transitive. You must update your projects using the following instructions to address both types of dependency. \n\nAdditionally, .NET Framework users must also install the November 2022 security patch to be protected. \n\n#### Direct dependencies \n\nDirect dependencies are discoverable by examining your\u202fcsproj\u202ffile. They can be fixed by editing the project file or using nuget command line to update the dependency. \n\n#### Transitive dependencies \n\nTransitive dependencies occur when you add a package to your project that in turn relies on another package. Transitive dependencies can be discovered by searching the\u202fproject.assets.json\u202ffile for each of your projects. This file is produced on each build and is in the obj directory for each project. \n\nThe\u202fproject.assets.json files are the authoritative list of all packages used by your project, containing both direct and transitive dependencies. \n\n#### Fixing direct dependencies \n\nDirect dependencies are nuget packages that have been specifically added to a project, rather than being pulled in because a nuget package added requires it. They can be seen in the solution explorer in Visual Studio or by opening the csproj for the project and examining the packageReference nodes for the package name, specified by the Include parameter, and its version, specified by the Version parameter.  \n\nFor example, the following project file has a direct dependency on version 2.1.1 of Microsoft.Data.SqlClient. \n```\n\u003cProject Sdk=\"Microsoft.NET.Sdk.Web\"\u003e \n\n  \u003cPropertyGroup\u003e \n    \u003cTargetFramework\u003enet6.0\u003c/TargetFramework\u003e \n    \u003cNullable\u003eenable\u003c/Nullable\u003e \n    \u003cImplicitUsings\u003eenable\u003c/ImplicitUsings\u003e \n  \u003c/PropertyGroup\u003e \n\n  \u003cItemGroup\u003e \n    \u003cPackageReference Include=\"Microsoft.Data.SqlClient\" Version=\"2.1.1\" /\u003e \n  \u003c/ItemGroup\u003e \n\n\u003c/Project\u003e \n```\n#### Fixing direct dependencies with the nuget command line \n\nOpen a command line to the directory holding your project \n\nRun the following command if you are using a version of Microsoft.Data.SqlClient between 2.0.0 and 2.1.1 \n\n\u003e dotnet add package Microsoft.Data.SqlClient --version 2.1.2 \n\nRun the following command if you are using a version of Microsoft.Data.SqlClient below 1.1.4 \n\n\u003e dotnet add package Microsoft.Data.SqlClient --version 1.1.4 \n\nRun the following command if you are using a version of System.Data.SqlClient below 4.8.4 \n\n\u003e dotnet add package System.Data.SqlClient --version 4.8.5 \n\n#### Fixing direct dependencies by editing the project file \n\nOpen\u202fprojectname.csproj\u202fin your editor. If you\u0027re using Visual Studio, right-click the project and choose\u202fEdit projectname.csproj\u202ffrom the context menu, where projectname is the name of your project.  \n\nLook for\u202fPackageReference\u202felements. The following shows an example project file: \n\n```\n\u003cProject Sdk=\"Microsoft.NET.Sdk.Web\"\u003e \n\n  \u003cPropertyGroup\u003e \n    \u003cTargetFramework\u003enet6.0\u003c/TargetFramework\u003e \n    \u003cNullable\u003eenable\u003c/Nullable\u003e \n    \u003cImplicitUsings\u003eenable\u003c/ImplicitUsings\u003e \n  \u003c/PropertyGroup\u003e \n\n  \u003cItemGroup\u003e \n    \u003cPackageReference Include=\"Microsoft.Data.SqlClient\" Version=\"2.1.1\" /\u003e \n  \u003c/ItemGroup\u003e \n\n\u003c/Project\u003e \n```\n\nThe preceding example has a reference tone of the vulnerable packages as seen by the single\u202fPackageReference\u202felement. The name of the package is in the\u202fInclude\u202fattribute. \nThe package version number is in the\u202fVersion\u202fattribute. \n\nTo update the version to the secure package, change the version number to the updated package version as listed in the Affected software section of this document. \n\nIn this example, update\u202fMicrosoft.Data.SqlClient to the appropriate fixed version for your major version. Save the\u202fcsproj\u202ffile. The example\u202fcsproj\u202fnow looks as follows: \n```\n\u003cProject Sdk=\"Microsoft.NET.Sdk.Web\"\u003e \n\n  \u003cPropertyGroup\u003e \n    \u003cTargetFramework\u003enet6.0\u003c/TargetFramework\u003e \n    \u003cNullable\u003eenable\u003c/Nullable\u003e \n    \u003cImplicitUsings\u003eenable\u003c/ImplicitUsings\u003e \n  \u003c/PropertyGroup\u003e \n\n  \u003cItemGroup\u003e \n    \u003cPackageReference Include=\"Microsoft.Data.SqlClient\" Version=\"2.1.2\" /\u003e \n  \u003c/ItemGroup\u003e \n\n\u003c/Project\u003e\n```\nIf you\u0027re using Visual Studio and you save your updated\u202fcsproj\u202ffile, Visual Studio will restore the new package version. \n\nYou can see the restore results by opening the\u202fOutput\u202fwindow (Ctrl+Alt+O) and changing the\u202fShow output from\u202fdrop-down list to\u202fPackage Manager. \n\nIf you\u0027re not using Visual Studio, open a command line and change to your project directory. Execute the\u202fdotnet restore\u202fcommand to restore the updated dependencies. \n\nNow recompile your application. If after recompilation you see a\u202fDependency conflict warning, you must update your other direct dependencies to versions that take a dependency on the updated package. \n\n#### Discovering and fixing transitive dependencies \n\nRebuild your solution and then open the\u202fproject.assets.json\u202ffile from in each of your project\u2019s obj directory in your editor. We suggest you use an editor that understands JSON and allows you to collapse and expand nodes to review this file. Both Visual Studio and Visual Studio Code provide JSON friendly editing. \n\nSearch the\u202fproject.assets.json\u202ffile for the\u202fvulnerable packages above using the format\u202fpackagename/\u202ffor each of the package names from the preceding table. If you find the assembly name in your search: \n\nExamine the line on which they are found, the version number is after the\u202f/. \n\nCompare to the vulnerable versions \n\nFor example, a search result that shows\u202f\"Microsoft.Data.SqlClient\": \"2.1.0\" is a reference to version 2.1.0 of\u202fMicrosoft.Data.SqlClient If your\u202fproject.assets.json\u202ffile includes vulnerable versions of the nuget packages then you need to fix the transitive dependencies. \n\nIf you have not found any reference to any vulnerable packages, this means either \n\nNone of your direct dependencies depend on any vulnerable packages, or \n\nYou have already fixed the problem by updating the direct dependencies. \n\nIf your transitive dependency review found references to the\u202fvulnerable package, you must add a direct dependency to the updated package to your\u202fcsproj\u202ffile to override the transitive dependency. \n\n#### Editing projects to fix transitive dependencies \n\nOpen\u202fprojectname.csproj\u202fin your editor. Look for\u202fPackageReference\u202fnodes, for example: \n```\n\u003cProject Sdk=\"Microsoft.NET.Sdk.Web\"\u003e \n\n  \u003cPropertyGroup\u003e \n    \u003cTargetFramework\u003enet6.0\u003c/TargetFramework\u003e \n    \u003cNullable\u003eenable\u003c/Nullable\u003e \n    \u003cImplicitUsings\u003eenable\u003c/ImplicitUsings\u003e \n  \u003c/PropertyGroup\u003e \n\n  \u003cItemGroup\u003e \n    \u003cPackageReference Include=\"IndirectDependency\" Version=\"1.0.0\" /\u003e \n  \u003c/ItemGroup\u003e \n\n\u003c/Project\u003e \n```\n\n\nYou must add a direct dependency to the updated, matching major/minor version of the vulnerable\u202fby adding it to the\u202fcsproj\u202ffile. This is done by adding a new line to the dependencies section, referencing the fixed version. For example,  \n```\n\u003cProject Sdk=\"Microsoft.NET.Sdk.Web\"\u003e \n\n  \u003cPropertyGroup\u003e \n    \u003cTargetFramework\u003enet6.0\u003c/TargetFramework\u003e \n    \u003cNullable\u003eenable\u003c/Nullable\u003e \n    \u003cImplicitUsings\u003eenable\u003c/ImplicitUsings\u003e \n  \u003c/PropertyGroup\u003e \n\n  \u003cItemGroup\u003e \n    \u003cPackageReference Include=\"IndirectDependency\" Version=\"1.0.0\" /\u003e \n    \u003cPackageReference Include=\"Microsoft.Data.SqlClient\" Version=\"2.1.2\" /\u003e \n  \u003c/ItemGroup\u003e \n\n\u003c/Project\u003e \n\n```\n\nAfter you\u0027ve added the direct dependency reference, save your\u202fcsproj\u202ffile. \n\nIf you\u0027re using Visual Studio, save your updated\u202fcsproj\u202ffile and Visual Studio will restore the new package versions. You can see the restore results by opening the\u202fOutput\u202fwindow (Ctrl+Alt+O) and changing the\u202fShow output from\u202fdrop-down list to\u202fPackage Manager. \n\nIf you\u0027re not using Visual Studio, open a command line and change to your project directory. Execute the\u202fdotnet restore\u202fcommand to restore the new dependencies. \n\n#### Using the nuget command line to fix transitive dependencies \n\nOpen a command window and change directory to your project directory.  \n\nRun the following command if you have an indirect dependency on Microsoft.Data.SqlClient between versions 2.0.0 and 2.1.1 \n\n\u003e dotnet add package Microsoft.Data.SqlClient --version 2.1.2 \n\nRun the following command if you have an indirect dependency on Microsoft.Data.SqlClient below 1.1.4 \n\n\u003e dotnet add package Microsoft.Data.SqlClient --version 1.1.4 \n\nRun the following command if you have an indirect dependency on System.Data.SqlClient below 4.8.4 \n\n\u003e dotnet add package System.Data.SqlClient --version 4.8.5 \n\nExecute the\u202fdotnet restore\u202fcommand to restore the new dependencies. \n\n#### Rebuilding your application \n\nFinally, you must rebuild your application, test, and redeploy. \n\n### Disclaimer\n\nThe information provided in this advisory is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.\n\n### Revisions\n\nV1.0 (November 8, 2022): Advisory published.\n\n_Version 1.0_\n\n_Last Updated 2022-11-08_",
  "id": "GHSA-8g2p-5pqh-5jmc",
  "modified": "2023-01-30T23:02:28Z",
  "published": "2022-11-08T23:00:22Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/dotnet/corefx/security/advisories/GHSA-8g2p-5pqh-5jmc"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41064"
    },
    {
      "type": "WEB",
      "url": "https://github.com/dotnet/runtime/issues/78042"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/dotnet/corefx"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41064"
    },
    {
      "type": "WEB",
      "url": "https://www.nuget.org/packages/Microsoft.Data.SqlClient"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": ".NET Information Disclosure Vulnerability"
}

{
  "GSD": {
    "alias": "CVE-2022-41064",
    "id": "GSD-2022-41064"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2022-41064"
      ],
      "details": ".NET Framework Information Disclosure Vulnerability",
      "id": "GSD-2022-41064",
      "modified": "2023-12-13T01:19:32.673088Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "secure@microsoft.com",
        "ID": "CVE-2022-41064",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "Nuget 2.1.2",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "1.0.0",
                          "version_value": "2.1.2"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Nuget 4.8.5",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "1.0.0",
                          "version_value": "4.8.4"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Microsoft .NET Framework 4.8",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "4.8.0",
                          "version_value": "4.8.04584.08"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "3.0.0.0",
                          "version_value": "10.0.14393.5501"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Microsoft .NET Framework 4.7.2",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "10.0.0.0",
                          "version_value": "10.0.04005.02"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Microsoft .NET Framework 4.8.1",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "4.8.0.0",
                          "version_value": "4.8.09110.07"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "4.7.0",
                          "version_value": "4.7.04005.02"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Microsoft .NET Framework 4.6.2",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "4.7.0",
                          "version_value": "4.7.04005.02"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Microsoft .NET Framework 4.6/4.6.2",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "10.0.0.0",
                          "version_value": "10.0.10240.19567"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "Microsoft"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": ".NET Framework Information Disclosure Vulnerability"
          }
        ]
      },
      "impact": {
        "cvss": [
          {
            "baseScore": 5.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C",
            "version": "3.1"
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "Information Disclosure"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-41064",
            "refsource": "MISC",
            "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-41064"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:a:microsoft:.net_framework:4.8:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:microsoft:.net_framework:4.8.1:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:microsoft:windows_server_2022:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:a:microsoft:.net_framework:4.6.2:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x64:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x86:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:a:microsoft:.net_framework:4.6.2:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:microsoft:.net_framework:4.7:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:microsoft:.net_framework:4.7.1:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:microsoft:.net_framework:4.7.2:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:microsoft:.net_framework:4.8:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:o:microsoft:windows_server_2008:r2:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:a:microsoft:.net_framework:4.8:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:microsoft:.net_framework:4.8.1:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:microsoft:windows_10:21h1:*:*:*:*:*:x64:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:o:microsoft:windows_10:21h1:*:*:*:*:*:arm64:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:o:microsoft:windows_10:21h1:*:*:*:*:*:x86:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:a:microsoft:.net_framework:4.6.2:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:microsoft:.net_framework:4.7:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:microsoft:.net_framework:4.7.1:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:microsoft:.net_framework:4.7.2:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:microsoft:.net_framework:4.8:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:x86:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:x64:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:a:microsoft:.net_framework:4.8:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:microsoft:.net_framework:4.8.1:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:microsoft:windows_10:21h2:*:*:*:*:*:arm64:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:o:microsoft:windows_10:21h2:*:*:*:*:*:x64:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:o:microsoft:windows_10:21h2:*:*:*:*:*:x86:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:a:microsoft:.net_framework:4.8:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:microsoft:.net_framework:4.8.1:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:microsoft:windows_10:20h2:*:*:*:*:*:x64:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:o:microsoft:windows_10:20h2:*:*:*:*:*:arm64:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:o:microsoft:windows_10:20h2:*:*:*:*:*:x86:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:a:microsoft:.net_framework:4.8:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:microsoft:.net_framework:4.8.1:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:microsoft:windows_10:22h2:*:*:*:*:*:x64:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:o:microsoft:windows_10:22h2:*:*:*:*:*:arm64:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:o:microsoft:windows_10:22h2:*:*:*:*:*:x86:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:a:microsoft:.net_framework:4.6.2:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:microsoft:.net_framework:4.7:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:microsoft:.net_framework:4.7.1:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:microsoft:.net_framework:4.7.2:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:microsoft:.net_framework:4.8:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:a:microsoft:.net_framework:4.7.2:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:microsoft:.net_framework:4.8:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:x64:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:x86:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:arm64:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:a:microsoft:.net_framework:4.8:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:x86:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:x64:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:a:microsoft:.net_framework:4.7.2:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:microsoft:.net_framework:4.8:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:a:microsoft:.net_framework:4.8:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:a:microsoft:.net_framework:4.7:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:microsoft:.net_framework:4.7.1:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:microsoft:.net_framework:4.7.2:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:microsoft:.net_framework:4.8:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:x64:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:x86:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:a:microsoft:.net_framework:4.6.2:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:x64:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:x86:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:a:microsoft:.net_framework:4.8:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:microsoft:.net_framework:4.8.1:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:microsoft:windows_11:-:*:*:*:*:*:x64:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:o:microsoft:windows_11:22h2:*:*:*:*:*:x64:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:microsoft:nuget:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "4.8.5",
                "versionStartIncluding": "3.0.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:microsoft:nuget:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2.1.2",
                "versionStartIncluding": "2.0.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:microsoft:nuget:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "1.1.4",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "secure@microsoft.com",
          "ID": "CVE-2022-41064"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": ".NET Framework Information Disclosure Vulnerability"
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "NVD-CWE-noinfo"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-41064",
              "refsource": "MISC",
              "tags": [
                "Patch",
                "Vendor Advisory"
              ],
              "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-41064"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "HIGH",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 1.3,
          "impactScore": 4.0
        }
      },
      "lastModifiedDate": "2023-10-17T19:01Z",
      "publishedDate": "2022-11-09T22:15Z"
    }
  }
}