9.8
CVE-2022-0749
- EPSS 1.7%
- Veröffentlicht 17.03.2022 12:15:07
- Zuletzt bearbeitet 21.11.2024 06:39:19
- Quelle report@snyk.io
- CVE-Watchlists
- Unerledigt
LoginDeserialization of Untrusted Data
This affects all versions of package SinGooCMS.Utility. The socket client in the package can pass in the payload via the user-controllable input after it has been established, because this socket client transmission does not have the appropriate restrictions or type bindings for the BinaryFormatter.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Singoo ≫ Singoocms.Utility Version-
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 1.7% | 0.741 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 9.8 | 3.9 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
|
| nvd@nist.gov | 7.5 | 10 | 6.4 |
AV:N/AC:L/Au:N/C:P/I:P/A:P
|
| report@snyk.io | 7.4 | 2.2 | 5.2 |
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
|
CWE-502 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
https://github.com/SinGooCMS/SinGooCMSUtility/blob/master/SinGooCMS.Utility/Net/SocketClient.cs
https://github.com/SinGooCMS/SinGooCMSUtility/issues/1
https://snyk.io/vuln/SNYK-DOTNET-SINGOOCMSUTILITY-2312979