Lucene search

SnykCVELIST:CVE-2022-0749

HistoryMar 17, 2022 - 11:20 a.m.

CVE-2022-0749 Deserialization of Untrusted Data

2022-03-1711:20:11

snyk

www.cve.org

cve-2022-0749

singoocms

deserialization

CVSS3

7.4

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H/E:P

AI Score

9.8

Confidence

High

EPSS

0.003

Percentile

71.3%

JSON

This affects all versions of package SinGooCMS.Utility. The socket client in the package can pass in the payload via the user-controllable input after it has been established, because this socket client transmission does not have the appropriate restrictions or type bindings for the BinaryFormatter.

CNA Affected

[
  {
    "product": "SinGooCMS.Utility",
    "vendor": "n/a",
    "versions": [
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

References

github.com/SinGooCMS/SinGooCMSUtility/blob/master/SinGooCMS.Utility/Net/SocketClient.cs

github.com/SinGooCMS/SinGooCMSUtility/issues/1

snyk.io/vuln/SNYK-DOTNET-SINGOOCMSUTILITY-2312979

CVSS3

7.4

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H/E:P

AI Score

9.8

Confidence

High

EPSS

0.003

Percentile

71.3%

JSON

Related for CVELIST:CVE-2022-0749