CVEvulnerability

CVE-2025-3424

7.7 HIGH Published 2025-04-07 Modified 2026-06-17 Official page ↗
Status
Deferred
Published
2025-04-07
Last modified
2026-06-17
Assigner
20705f08-db8b-4497-8f94-7eea62317651
CVSS 4.0 (20705f08-db8b-4497-8f94-7eea62317651)
7.7 HIGH — CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:U/V:C/RE:M/U:Green
Weaknesses
CWE-22

Description

The IntelliSpace portal application utilizes .NET Remoting for its functionality. The vulnerability arises from the exploitation of port 755 through the "Object Marshalling" technique, which allows an attacker to read internal files without any authentication. This is possible by crafting specific .NET Remoting URLs derived from information enumerated in the client-side configuration files. This issue affects IntelliSpace Portal: 12 and prior.

Related

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References