QID 91854

Date Published: 2022-01-12

QID 91854: Microsoft .NET Framework Denial of Service (DoS) Vulnerability for January 2022

A denial of service vulnerability exist in Microsoft .Net Framework.

Following KBs are covered in this detection:
KB5008876
KB5008877
KB5008879
KB5008880
KB5008882
KB5009546
KB5009585
KB5009711
KB5009712
KB5009713
KB5009714
KB5009718
KB5009719
KB5009720
KB5009721
KB5009722
This security update is rated Important for supported versions of Microsoft .NET Framework.

.NET Framework 3.5, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, 4.7.2 and 4.8

QID Detection Logic (Authenticated):
- Checks for vulnerable version of System.web.dll for .Net Framework

Successful exploitation allows attacker to cause denial of service vulnerability.

CVSS V3 rated as High - 7.5 severity.

CVSS V2 rated as Medium - 5 severity.

Solution

Customers are advised to refer to CVE-2022-21911 for more details pertaining to this vulnerability.

Vendor References

KB5008876 - support.microsoft.com/help/5008876
KB5008877 - support.microsoft.com/help/5008877
KB5008879 - support.microsoft.com/help/5008879
KB5008880 - support.microsoft.com/help/5008880
KB5008882 - support.microsoft.com/help/5008882
KB5009546 - support.microsoft.com/help/5009546
KB5009585 - support.microsoft.com/help/5009585
KB5009711 - support.microsoft.com/help/5009711
KB5009712 - support.microsoft.com/help/5009712
KB5009713 - support.microsoft.com/help/5009713
KB5009714 - support.microsoft.com/help/5009714
KB5009718 - support.microsoft.com/help/5009718
KB5009719 - support.microsoft.com/help/5009719
KB5009720 - support.microsoft.com/help/5009720
KB5009721 - support.microsoft.com/help/5009721
KB5009722 - support.microsoft.com/help/5009722

CVEs related to QID 91854

CVE-2022-21911 |

Software Advisories

Advisory ID	Software	Component	Link
CVE-2022-21911			msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21911

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].