CVE-2021-27852criticalunder attackCWE-502

CVE-2021-27852: critical vulnerability in Checkbox Survey

Published · Updated

Follow this CVE+ Monitor Survey

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

70Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Actcvss 9.8epss 30%
from disclosure to weapon
Published on NVDMay 27
CISA KEV+319d
Action required by CISAfederal deadline: 2022-05-02

Versions 6 and earlier for this product are end-of-life and must be removed from agency networks. Versions 7 and later are not considered vulnerable.

In short

Checkbox Survey versions before 7 contain a critical flaw that allows attackers to run malicious code on the server without needing to log in. The vulnerability exists in how the software handles untrusted data, making it an urgent security risk.

Technical detail

CVE-2021-27852 is an unsafe deserialization vulnerability (CWE-502) in CheckboxWeb.dll that allows unauthenticated remote code execution. Attackers can send malicious serialized objects that execute arbitrary code when deserialized by the application. This affects all Checkbox Survey versions prior to 7, with no authentication required.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Deserialization of Untrusted Data vulnerability in CheckboxWeb.dll of Checkbox Survey allows an unauthenticated remote attacker to execute arbitrary code. This issue affects: Checkbox Survey versions prior to 7.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Checkbox · Survey