Information disclosure in Microsoft products - CVE-2022-30187
Published: July 12, 2022
Vulnerability identifier: #VU65206
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2022-30187
CWE-ID: CWE-200
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vendor: Microsoft
Affected software:
Azure Storage Queues client library for Python
Azure Storage Queues client library for .NET
Azure Storage Blobs client library for Python
Azure Storage Blobs client library for Java
Azure Storage Blobs client library for .NET
Azure Storage Queues client library for Python
Azure Storage Queues client library for .NET
Azure Storage Blobs client library for Python
Azure Storage Blobs client library for Java
Azure Storage Blobs client library for .NET
Detailed vulnerability description
The vulnerability allows a local user to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output by the application in Azure Storage Library. A local user can gain unauthorized access to sensitive information on the system.
How to mitigate CVE-2022-30187
Install updates from vendor's website.