GitHub Advisoryadvisory · NuGet

GHSA-vh38-ghx6-vmvg Code Injection in Masuit.Tools.Core

HIGH Published 2022-05-03 Modified 2022-05-23 Official page ↗
Aliases
CVE-2022-21167
Ecosystem
NuGet
Packages
Masuit.Tools.Core
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-94
Reviewed
2022-05-23

Affected packages

• NuGet Masuit.Tools.Core: <= 2.4.8.6 (no fix yet)

Description

All versions of package Masuit.Tools.Core are vulnerable to Arbitrary Code Execution via the ReceiveVarData function in the SocketClient.cs component. The socket client in the package can pass in the payload via the user-controllable input after it has been established, because this socket client transmission does not have the appropriate restrictions or type bindings for the BinaryFormatter.

Related

Alias · CVE (1)

  • CVE-2022-21167 All versions of package masuit.tools.core are vulnerable to Arbitrary Code Execution via the ReceiveVarData<T> function in the… vulnerability

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References