Deserialization of Untrusted Data (AjaxPro.2)
At a glance
- Source
- NVD
- EPSS
- EPSS 82.58 % · percentile 100 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- snyk
- NVD status
- Analyzed
Description
All versions of package ajaxpro.2 are vulnerable to Deserialization of Untrusted Data due to the possibility of deserialization of arbitrary .NET classes, which can be abused to gain remote code execution.
Weaknesses (CWE)
- CWE-502 — Deserialization of Untrusted Data
References
- https://snyk.io/vuln/SNYK-DOTNET-AJAXPRO2-1925971
- https://github.com/michaelschwarz/Ajax.NET-Professional/commit/b0e63be5f0bb20dfce507cb8a1a9568f6e73de57
- http://packetstormsecurity.com/files/175677/AjaxPro-Deserialization-Remote-Code-Execution.html
- https://blog.talosintelligence.com/uat-10147-chinese-speaking-adversary-integrates-agentic-ai-into-post-compromise-operations/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-23758
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 8.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H | snyk |
| CVSS 3.1 | HIGH 8.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · report@snyk.io (Secondary) |
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | HIGH 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-6r7c-6w96-8pvw — Remote Code Execution in AjaxNetProfessional
European references
- ENISA EUVD · EUVD-2021-2466
- GCVE · GCVE-0-2021-23758
Affected configurations (NVD CPE)
cpe:2.3:a:ajaxpro.2_project:ajaxpro.2:*:*:*:*:*:.net:*:*cpe:2.3:a:michaelschwarz:ajax.net_professional:*:*:*:*:*:.net:*:*< 21.10.30.1
Affected products
| Product | Versions |
|---|---|
| AjaxPro.2 | affected 0 < unspecified |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| CISA Known Exploited Vulnerabilities | CC0 1.0 |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |