Open-source package vulnerability · NuGet

CVE-2024-28698: CLSA Directory Traversal vulnerability

criticalCVSS 4.0 9.3 · 3.1 9.8GHSA-9xhh-3m78-gvgj

Directory Traversal vulnerability in Marimer LLC CSLA .Net before 8.0 allows a remote attacker to execute arbitrary code via a crafted script to the MobileFormatter component. Fixes for this issue have been backported to the 5.x, 6.x, and 7.x branches of CSLA. CSLA version 5.5.4 contains a fix. As of time of publication, 6.x and 7.x do not have numbered versions containing the fix but do have fix commits available.

Published Jul 22, 2024 · Updated Aug 15, 2024

Affected packages

Csla

Ecosystem: NuGet
Affected: < 5.5.4
Fixed in: 5.5.4
Check: dotnet list package --include-transitive

Csla

Ecosystem: NuGet
Affected: >= 6.0.0, <= 6.2.2
Fixed in: 8.0.0
Check: dotnet list package --include-transitive

Csla

Ecosystem: NuGet
Affected: >= 7.0.0, <= 7.0.5
Fixed in: 8.0.0
Check: dotnet list package --include-transitive

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Directory Traversal vulnerability in Marimer LLC CSLA .Net before 8.0 allows a remote attacker to execute arbitrary code via a crafted script to the MobileFormatter component.

Fixes for this issue have been backported to the 5.x, 6.x, and 7.x branches of CSLA. CSLA version 5.5.4 contains a fix. As of time of publication, 6.x and 7.x do not have numbered versions containing the fix but do have fix commits available.

Credited to rockfordlhotka.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology