CVE-2021-23758

Deserialization of Untrusted Data

CVSS 8.1 HIGHEPSS 88.8%

All versions of package ajaxpro.2 are vulnerable to Deserialization of Untrusted Data due to the possibility of deserialization of arbitrary .NET classes, which can be abused to gain remote code execution.

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

n/a · AjaxPro.2

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://packetstormsecurity.com/files/175677/AjaxPro-Deserialization-Remote-Code-Execution.html https://github.com/michaelschwarz/Ajax.NET-Professional/commit/b0e63be5f0bb20dfce507cb8a1a9568f6e73de57 https://snyk.io/vuln/SNYK-DOTNET-AJAXPRO2-1925971