GHSA-74r6-grj9-8rq6
Duplicate Advisory: Remote Code Execution in AjaxNetProfessional
Withdrawn ·
At a glance
- Published
- Updated
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-6r7c-6w96-8pvw. This link is maintained to preserve external references. ## Original Description All versions of package ajaxpro.2 are vulnerable to Deserialization of Untrusted Data due to the possibility of deserialization of arbitrary .NET classes, which can be abused to gain remote code execution.
Affected packages
| Package | Versions |
|---|---|
| NuGet · AjaxNetProfessional | introduced 0, fixed 21.11.29.1 |
References
- https://github.com/michaelschwarz/Ajax.NET-Professional/security/advisories/GHSA-6r7c-6w96-8pvw WEB
- https://nvd.nist.gov/vuln/detail/CVE-2021-23758 ADVISORY
- https://github.com/michaelschwarz/Ajax.NET-Professional/commit/b0e63be5f0bb20dfce507cb8a1a9568f6e73de57 WEB
- https://github.com/michaelschwarz/Ajax.NET-Professional PACKAGE
- https://snyk.io/vuln/SNYK-DOTNET-AJAXPRO2-1925971 WEB
- http://packetstormsecurity.com/files/175677/AjaxPro-Deserialization-Remote-Code-Execution.html WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |