GitHub Advisoryadvisory · NuGet
GHSA-mx3q-j2g2-5qxq Deserialization of Untrusted Data in NancyFX Nancy
CRITICAL
Official page ↗
- Aliases
- CVE-2017-9785
- Ecosystem
- NuGet
- Packages
- Nancy
- Severity
- Critical
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-502
- Reviewed
- 2022-06-30
Affected packages
• NuGet Nancy: < 1.4.4 → fixed in 1.4.4
• NuGet Nancy: >= 2.0.0-alpha, < 2.0.0 → fixed in 2.0.0
Description
Csrf.cs in NancyFX Nancy before 1.4.4 and 2.x before 2.0-dangermouse has Remote Code Execution via Deserialization of JSON data in a CSRF Cookie.
Related
Alias · CVE (1)
- CVE-2017-9785 Csrf.cs in NancyFX Nancy before 1.4.4 and 2.x before 2.0-dangermouse has Remote Code Execution via Deserialization of JSON data in a CSRF… vulnerability
Weakness · CWE (1)
- CWE-502 Deserialization of Untrusted Data weakness