Azure Storage Library Information Disclosure Vulnerability
Priority MEDIUM 55CWE-327Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from Microsoft.
Summary
Azure Storage Library Information Disclosure Vulnerability
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00532 45th percentileScored 2026-11-07
Fix Fixed Azure Storage Blobs client library for .NET (Microsoft): 12.13.0Azure Storage Queues client library for .NET (Microsoft): 12.13.0+8 more productsRed Hat: 1 advisory
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Microsoft | Azure Storage Blobs client library for .NET | 12.0.0 to before 12.13.0 | 12.13.0 | Patch available | CNA |
| Microsoft | Azure Storage Queues client library for .NET | 12.0.0 to before 12.13.0 | 12.13.0 | Patch available | CNA |
| Microsoft | Azure Storage Blobs client library for Java | 12.0.0 to before 12.18.0 | 12.18.0 | Patch available | CNA |
| Microsoft | Azure Storage Queues client library for Python | 12.0.0 to before 12.4.0 | 12.4.0 | Patch available | CNA |
| Microsoft | Azure Storage Blobs client library for Python | 12.0.0 to before 12.13.0 | 12.13.0 | Patch available | CNA |
| — | Azure.Storage.Queues (NuGet) | before 12.11.0 | 12.11.0 | Patch available | GHSA-64x4-9hc6-r2h6 |
| — | Azure.Storage.Blobs (NuGet) | before 12.13.0 | 12.13.0 | Patch available | GHSA-64x4-9hc6-r2h6 |
| — | com.azure:azure-storage-blob (Maven) | before 12.18.0 | 12.18.0 | Patch available | GHSA-64x4-9hc6-r2h6 |
| — | azure-storage-queue (PyPI) | before 12.4.0 | 12.4.0 | Patch available | GHSA-64x4-9hc6-r2h6 |
| — | azure-storage-blob (PyPI) | before 12.13.0 | 12.13.0 | Patch available | GHSA-64x4-9hc6-r2h6 |
- Azure Storage Blobs client library for .NET VendorMicrosoft Affected 12.0.0 to before 12.13.0 Fixed in 12.13.0 Patch available CNA
- Azure Storage Queues client library for .NET VendorMicrosoft Affected 12.0.0 to before 12.13.0 Fixed in 12.13.0 Patch available CNA
- Azure Storage Blobs client library for Java VendorMicrosoft Affected 12.0.0 to before 12.18.0 Fixed in 12.18.0 Patch available CNA
- Azure Storage Queues client library for Python VendorMicrosoft Affected 12.0.0 to before 12.4.0 Fixed in 12.4.0 Patch available CNA
- Azure Storage Blobs client library for Python VendorMicrosoft Affected 12.0.0 to before 12.13.0 Fixed in 12.13.0 Patch available CNA
- Azure.Storage.Queues (NuGet) Vendor— Affected before 12.11.0 Fixed in 12.11.0 Patch available GHSA-64x4-9hc6-r2h6
- Azure.Storage.Blobs (NuGet) Vendor— Affected before 12.13.0 Fixed in 12.13.0 Patch available GHSA-64x4-9hc6-r2h6
- com.azure:azure-storage-blob (Maven) Vendor— Affected before 12.18.0 Fixed in 12.18.0 Patch available GHSA-64x4-9hc6-r2h6
- azure-storage-queue (PyPI) Vendor— Affected before 12.4.0 Fixed in 12.4.0 Patch available GHSA-64x4-9hc6-r2h6
- azure-storage-blob (PyPI) Vendor— Affected before 12.13.0 Fixed in 12.13.0 Patch available GHSA-64x4-9hc6-r2h6
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:microsoft:azure_storage_blobs:*:*:*:*:*:.net:*:* | before 12.13.0 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:azure_storage_blobs:*:*:*:*:*:python:*:* | before 12.13.0 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:azure_storage_blobs:*:*:*:*:*:java:*:* | before 12.18.0 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:azure_storage_queue:*:*:*:*:*:python:*:* | before 12.4.0 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:azure_storage_queue:*:*:*:*:*:.net:*:* | before 12.11.0 | Vulnerable | Microsoft |
- cpe:2.3:a:microsoft:azure_storage_blobs:*:*:*:*:*:.net:*:* Versions before 12.13.0 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:azure_storage_blobs:*:*:*:*:*:python:*:* Versions before 12.13.0 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:azure_storage_blobs:*:*:*:*:*:java:*:* Versions before 12.18.0 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:azure_storage_queue:*:*:*:*:*:python:*:* Versions before 12.4.0 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:azure_storage_queue:*:*:*:*:*:.net:*:* Versions before 12.11.0 Vulnerable ·Microsoft
Remediation
- Fix · CNA Azure Storage Blobs client library for .NET (Microsoft) Fixed in 12.13.0
- Fix · CNA Azure Storage Queues client library for .NET (Microsoft) Fixed in 12.13.0
- Fix · CNA Azure Storage Blobs client library for Java (Microsoft) Fixed in 12.18.0
- Fix · CNA Azure Storage Queues client library for Python (Microsoft) Fixed in 12.4.0
- Fix · CNA Azure Storage Blobs client library for Python (Microsoft) Fixed in 12.13.0
- Fix · GHSA-64x4-9hc6-r2h6 Azure.Storage.Queues (NuGet) Fixed in 12.11.0 Advisory →
- Fix · GHSA-64x4-9hc6-r2h6 Azure.Storage.Blobs (NuGet) Fixed in 12.13.0 Advisory →
- Fix · GHSA-64x4-9hc6-r2h6 com.azure:azure-storage-blob (Maven) Fixed in 12.18.0 Advisory →
- Fix · GHSA-64x4-9hc6-r2h6 azure-storage-queue (PyPI) Fixed in 12.4.0 Advisory →
- Fix · GHSA-64x4-9hc6-r2h6 azure-storage-blob (PyPI) Fixed in 12.13.0 Advisory →
Red Hat 1 advisory
- RHSA-2026:4215 Released 2026-03-10 · Red Hat rating ImportantRed Hat Quay 3.14.6
- Red Hat Quay 3.14 registry.redhat.io/quay/quay-rhel8
Vendor assessments
Microsoft
Microsoft's page for this CVE →
- Impact
- Information Disclosure
- Exploited
- No
- Publicly disclosed
- No
- Exploitability
- Exploitation Less Likely
| Product | Status | Plan or fix |
|---|---|---|
| Azure Storage Blobs client library for .NET | Fixed | 12.13.0 · Security Update |
| Azure Storage Blobs client library for Java | Fixed | 12.18.0 · Security Update |
| Azure Storage Blobs client library for Python | Fixed | 12.13.0 · Security Update |
| Azure Storage Queues client library for .NET | Fixed | 12.13.0 · Security Update |
| Azure Storage Queues client library for Python | Fixed | 12.4.0 · Security Update |
Timeline
- 2026-10-02 Threatist record created from CVE-2022-30187
- 2026-10-03 Alias added: GHSA-64x4-9hc6-r2h6
References
Sources
- CVE-2022-30187 · CVE Program
- CVE-2022-30187 · NVD
- FIRST EPSS
- GHSA-64x4-9hc6-r2h6 · GitHub Advisory Database · CC BY 4.0
- CVE-2022-30187 · Microsoft Security Update Guide
- CVE-2022-30187 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences