CVE-2023-49289
published 2023-12-05CVE-2023-49289: Ajax.NET Professional (AjaxPro) is an AJAX framework for Microsoft ASP.NET which will create proxy JavaScript classes that are used on client-side to invoke…
PriorityP425medium5.4CVSS 3.1
AVNACLPRNUIRSUCLILAN
EPSS
0.63%
47.7th percentile
Ajax.NET Professional (AjaxPro) is an AJAX framework for Microsoft ASP.NET which will create proxy JavaScript classes that are used on client-side to invoke methods on the web server. Affected versions of this package are vulnerable cross site scripting attacks. Releases before version 21.12.22.1 are affected. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| michaelschwarz | ajax.net-professional | < 21.12.22.1 | 21.12.22.1 |
| michaelschwarz | ajax.net_professional | < 21.12.22.1 | 21.12.22.1 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Ajax Pro Cross-site Scripting
ghsa·2023-12-05
CVE-2023-49289 [MEDIUM] CWE-79 Ajax Pro Cross-site Scripting
Ajax Pro Cross-site Scripting
### Overview
Affected versions of this package are vulnerable to Deserialization of Untrusted Data due to the possibility of deserialization of arbitrary JavaScript objects.
### Description
Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user. Flaws that allow these attacks to succeed are quite widespread and occur anywhere a web application uses input from a user within the output it generates without validating or encoding it.
XSS effects vary in range from petty nuisance to significant security risk, depending o
OSV
Ajax Pro Cross-site Scripting
osv·2023-12-05
CVE-2023-49289 [MEDIUM] Ajax Pro Cross-site Scripting
Ajax Pro Cross-site Scripting
### Overview
Affected versions of this package are vulnerable to Deserialization of Untrusted Data due to the possibility of deserialization of arbitrary JavaScript objects.
### Description
Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user. Flaws that allow these attacks to succeed are quite widespread and occur anywhere a web application uses input from a user within the output it generates without validating or encoding it.
XSS effects vary in range from petty nuisance to significant security risk, depending o
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/michaelschwarz/Ajax.NET-Professional/commit/c89e39b9679fcb8ab6644fe21cc7e652cb615e2bhttps://github.com/michaelschwarz/Ajax.NET-Professional/security/advisories/GHSA-8v6j-gc74-fmpphttps://www.nuget.org/packages/AjaxNetProfessional/https://github.com/michaelschwarz/Ajax.NET-Professional/commit/c89e39b9679fcb8ab6644fe21cc7e652cb615e2bhttps://github.com/michaelschwarz/Ajax.NET-Professional/security/advisories/GHSA-8v6j-gc74-fmpphttps://www.nuget.org/packages/AjaxNetProfessional/
2023-12-05
Published