GitHub Advisoryadvisory · NuGet

GHSA-9xhh-3m78-gvgj CLSA Directory Traversal vulnerability

CRITICAL Published 2024-07-22 Modified 2024-08-15 Official page ↗
Aliases
CVE-2024-28698
Ecosystem
NuGet
Packages
Csla
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-22
Reviewed
2024-08-02

Affected packages

• NuGet Csla: < 5.5.4 → fixed in 5.5.4 • NuGet Csla: >= 6.0.0, < 8.0.0 → fixed in 8.0.0 • NuGet Csla: >= 7.0.0, < 8.0.0 → fixed in 8.0.0

Description

Directory Traversal vulnerability in Marimer LLC CSLA .Net before 8.0 allows a remote attacker to execute arbitrary code via a crafted script to the MobileFormatter component. Fixes for this issue have been backported to the 5.x, 6.x, and 7.x branches of CSLA. CSLA version 5.5.4 contains a fix. As of time of publication, 6.x and 7.x do not have numbered versions containing the fix but do have fix commits available.

Related

Alias · CVE (1)

  • CVE-2024-28698 Directory Traversal vulnerability in Marimer LLC CSLA .Net before 8.0 allows a remote attacker to execute arbitrary code via a crafted… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References