CVE-2022-30184: Potential leak of NuGet.org API key

Quick answers

Is CVE-2022-30184 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2022-30184 being exploited in the wild.

How severe is CVE-2022-30184?

Low severity, with a CVSS score of 3.1, published 14 June 2022.

Which products and versions are affected?

NuGet.CommandLine (NuGet) ECOSYSTEM:introduced=3.5.0,fixed=4.9.5; NuGet.CommandLine.XPlat (NuGet) ECOSYSTEM:introduced=3.5.0,fixed=4.9.5; NuGet.Commands (NuGet) ECOSYSTEM:introduced=3.5.0,fixed=4.9.5.

Is there a fix for CVE-2022-30184?

Yes. NuGet.CommandLine (NuGet): upgrade to 4.9.5 or later; NuGet.CommandLine.XPlat (NuGet): upgrade to 4.9.5 or later; NuGet.Commands (NuGet): upgrade to 4.9.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Am I affected by CVE-2022-30184?

Check whether you run NuGet.CommandLine (NuGet), NuGet.CommandLine.XPlat (NuGet) or NuGet.Commands (NuGet) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

• NuGet.CommandLine (NuGet): upgrade to 4.9.5 or later

  dotnet add package NuGet.CommandLine --version 4.9.5

• NuGet.CommandLine.XPlat (NuGet): upgrade to 4.9.5 or later

  dotnet add package NuGet.CommandLine.XPlat --version 4.9.5

• NuGet.Commands (NuGet): upgrade to 4.9.5 or later

  dotnet add package NuGet.Commands --version 4.9.5

Affected products

• NuGet.CommandLine (NuGet) ECOSYSTEM:introduced=3.5.0,fixed=4.9.5
• NuGet.CommandLine.XPlat (NuGet) ECOSYSTEM:introduced=3.5.0,fixed=4.9.5
• NuGet.Commands (NuGet) ECOSYSTEM:introduced=3.5.0,fixed=4.9.5

Identifiers

• CVE-2022-30184
• GHSA-3885-8gqc-3wpf