CVE-2021-43853
published 2021-12-22CVE-2021-43853: Ajax.NET Professional (AjaxPro) is an AJAX framework available for Microsoft ASP.NET. Affected versions of this package are vulnerable to JavaScript object…
PriorityP426medium5.4CVSS 3.1
AVNACLPRLUIRSCCLILAN
EPSS
0.82%
54.8th percentile
Ajax.NET Professional (AjaxPro) is an AJAX framework available for Microsoft ASP.NET. Affected versions of this package are vulnerable to JavaScript object injection which may result in cross site scripting when leveraged by a malicious user. The affected core relates to JavaScript object creation when parsing json input. Releases before version 21.12.22.1 are affected. A workaround exists that replaces one of the core JavaScript files embedded in the library. See the GHSA-5q7q-qqw2-hjq7 for workaround details.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ajax.net_professional_project | ajax.net_professional | < 21.12.22.1 | 21.12.22.1 |
| michaelschwarz | ajax.net-professional | < 21.12.22.1 | 21.12.22.1 |
CVSS provenance
nvdv3.15.4MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
nvdv2.03.5LOWAV:N/AC:M/Au:S/C:N/I:P/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
AjaxNetProfessional deserializes arbitrary JavaScript objects
osv·2022-01-06
CVE-2021-43853 [HIGH] AjaxNetProfessional deserializes arbitrary JavaScript objects
AjaxNetProfessional deserializes arbitrary JavaScript objects
### Overview
Affected versions of this package are vulnerable to Deserialization of Untrusted Data due to the possibility of deserialization of arbitrary JavaScript objects.
### Description
Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user. Flaws that allow these attacks to succeed are quite widespread and occur anywhere a web application uses input from a user within the output it generates without validating or encoding it.
XSS effects vary in range from petty nuisance to signif
GHSA
AjaxNetProfessional deserializes arbitrary JavaScript objects
ghsa·2022-01-06
CVE-2021-43853 [HIGH] CWE-502 AjaxNetProfessional deserializes arbitrary JavaScript objects
AjaxNetProfessional deserializes arbitrary JavaScript objects
### Overview
Affected versions of this package are vulnerable to Deserialization of Untrusted Data due to the possibility of deserialization of arbitrary JavaScript objects.
### Description
Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user. Flaws that allow these attacks to succeed are quite widespread and occur anywhere a web application uses input from a user within the output it generates without validating or encoding it.
XSS effects vary in range from petty nuisance to signif
No detection rules found.
No writeups or analysis indexed.
https://github.com/michaelschwarz/Ajax.NET-Professional/commit/c89e39b9679fcb8ab6644fe21cc7e652cb615e2bhttps://github.com/michaelschwarz/Ajax.NET-Professional/releases/tag/v21.12.22.1https://github.com/michaelschwarz/Ajax.NET-Professional/security/advisories/GHSA-5q7q-qqw2-hjq7https://github.com/michaelschwarz/Ajax.NET-Professional/commit/c89e39b9679fcb8ab6644fe21cc7e652cb615e2bhttps://github.com/michaelschwarz/Ajax.NET-Professional/releases/tag/v21.12.22.1https://github.com/michaelschwarz/Ajax.NET-Professional/security/advisories/GHSA-5q7q-qqw2-hjq7
2021-12-22
Published