GitHub Advisoryadvisory · NuGet

GHSA-w65q-jcmv-28gj Dynamic Linq vulnerable to remote code execution

CRITICAL Published 2023-06-22 Modified 2023-07-03 Official page ↗
Aliases
CVE-2023-32571
Ecosystem
NuGet
Packages
System.Linq.Dynamic.Core
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-697
Reviewed
2023-06-23

Affected packages

• NuGet System.Linq.Dynamic.Core: >= 1.0.7.10, < 1.3.0 → fixed in 1.3.0

Description

Dynamic Linq 1.0.7.10 through 1.2.25 before 1.3.0 allows attackers to execute arbitrary code and commands when untrusted input to methods including Where, Select, OrderBy is parsed.

Related

Alias · CVE (1)

  • CVE-2023-32571 Dynamic Linq 1.0.7.10 through 1.2.25 before 1.3.0 allows attackers to execute arbitrary code and commands when untrusted input to methods… vulnerability

Weakness · CWE (1)

  • CWE-697 Incorrect Comparison weakness

References