CVEvulnerability
CVE-2018-20221
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2019-03-21
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 8.8 HIGH — CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 6.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:P
- Weaknesses
- CWE-502
Description
Secure/SAService.rem in Deltek Ajera Timesheets 9.10.16 and prior are vulnerable to remote code execution via deserialization of untrusted user input from an authenticated user. The executed code will run as the IIS Application Pool that is running the application.
Affected configurations
• deltek ajera (<= 9.10.16)
Related
Weakness · CWE (1)
- CWE-502 Deserialization of Untrusted Data weakness
References
- http://packetstormsecurity.com/files/151035/Ajera-Timesheets-9.10.16-Deserialization.html Exploit, Third Party Advisory, VDB Entry
- https://www.exploit-db.com/exploits/46086/ Exploit, Third Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/151035/Ajera-Timesheets-9.10.16-Deserialization.html Exploit, Third Party Advisory, VDB Entry
- https://www.exploit-db.com/exploits/46086/ Exploit, Third Party Advisory, VDB Entry