{"id":"CVE-2022-26907","aliases":["EUVD-2022-1856","GHSA-whph-446h-6m9v"],"status":"published","title":"Azure SDK for .NET Information Disclosure Vulnerability","description":"Azure SDK for .NET Information Disclosure Vulnerability","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.0236,"percentile":0.83889,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-532"],"published":"2022-04-15T19:05:43Z","modified":"2026-06-17T04:36:05Z","fixes":[{"ecosystem":"NuGet","package":"Microsoft.Rest.ClientRuntime","fixed_in":["2.3.24"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.Rest.ClientRuntime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.24"}]}]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.Rest.ClientRuntime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.24"}]}],"versions":["0.9.4","0.9.5","0.9.6","1.0.0","1.0.1","1.0.2","1.0.3","1.1.0","1.1.1","1.2.0","1.3.0","1.4.0","1.4.1","1.5.0","1.6.0","1.8.0","1.8.1","1.8.2","1.9.0","2.0.0","2.0.1","2.1.0","2.2.0","2.3.0","2.3.1","2.3.10","2.3.11","2.3.12","2.3.13","2.3.14","2.3.15","2.3.16","2.3.17","2.3.18","2.3.19","2.3.2","2.3.20","2.3.21","2.3.22","2.3.23","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7","2.3.8","2.3.9"]}],"products":[{"vendor":"microsoft","product":"azure sdk for .net"},{"vendor":"microsoft","product":"azure_sdk_for_.net"}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26907","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-26907","tags":["advisory"]},{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-26907","tags":["web"]},{"url":"https://github.com/Azure/azure-sdk-for-net/blob/a919c48ae294fed084a9679b6f53ac6af3fb4c3a/sdk/mgmtcommon/ClientRuntime/ClientRuntime/Microsoft.Rest.ClientRuntime.csproj#L11","tags":["web"]},{"url":"https://github.com/Azure/azure-sdk-for-net/pull/28169","tags":["web"]},{"url":"https://github.com/Azure/azure-sdk-for-net/commit/e67f2a9fc5aa1060bd465d1458c347671268f6f5","tags":["web"]},{"url":"https://github.com/advisories/GHSA-whph-446h-6m9v"},{"url":"https://github.com/Azure/azure-sdk-for-net","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2022-26907","title":"Azure SDK for .NET Information Disclosure Vulnerability","description":"Azure SDK for .NET Information Disclosure Vulnerability","status":"published","published":"2022-04-15T19:05:43Z","modified":"2025-01-02T18:52:16.339Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C","level":"medium","assessor":"cna"}],"updated_at":"2026-11-02T14:34:25.954329Z"}],"euvd":[{"id":"EUVD-2022-1856","description":"Azure SDK for .NET Information Disclosure Vulnerability","status":"published","published":"2022-04-15T19:05:43Z","modified":"2025-01-02T18:52:16Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C","level":"medium"}],"updated_at":"2026-11-03T00:04:28.496186Z"}],"ghsa":[{"id":"GHSA-whph-446h-6m9v","title":"Azure SDK for .NET Information Disclosure Vulnerability.","description":"Azure SDK for .NET Information Disclosure Vulnerability via undisclosed methods relating to lack of sanitization of exception messages.","status":"published","published":"2022-04-16T00:00:28Z","modified":"2023-08-03T19:31:44Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T14:36:59.456342Z"}],"nvd":[{"id":"CVE-2022-26907","description":"Azure SDK for .NET Information Disclosure Vulnerability","status":"published","published":"2022-04-15T19:15:15.077Z","modified":"2026-06-17T04:36:05.803Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T14:07:16.9948Z"}],"osv":[{"id":"GHSA-whph-446h-6m9v","title":"Azure SDK for .NET Information Disclosure Vulnerability.","description":"Azure SDK for .NET Information Disclosure Vulnerability via undisclosed methods relating to lack of sanitization of exception messages.","status":"published","published":"2022-04-16T00:00:28Z","modified":"2024-02-16T08:21:14.568681Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T15:46:58.767335Z"}]}}