CVE-2021-43853
Affected versions of this package are vulnerable to JavaScript object injection which may result in cross site scripting when leveraged by a malicious user.
Does this matter?
Lower severity and a low EPSS score (0.82%). Track it; it rarely justifies an emergency change on its own.
Description
Ajax.NET Professional (AjaxPro) is an AJAX framework available for Microsoft ASP.NET. Affected versions of this package are vulnerable to JavaScript object injection which may result in cross site scripting when leveraged by a malicious user. The affected core relates to JavaScript object creation when parsing json input. Releases before version 21.12.22.1 are affected. A workaround exists that replaces one of the core JavaScript files embedded in the library. See the GHSA-5q7q-qqw2-hjq7 for workaround details.
- CVSS 3.1
- 5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 0.82% probability · 55th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79, CWE-502
- Affected
- ajax.net professional project/ajax.net professional
- Source
- security-advisories@github.com
References
- https://github.com/michaelschwarz/Ajax.NET-Professional/commit/c89e39b9679fcb8ab6644fe21cc7e652cb615e2bPatch, Third Party Advisory
- https://github.com/michaelschwarz/Ajax.NET-Professional/releases/tag/v21.12.22.1Release Notes, Third Party Advisory
- https://github.com/michaelschwarz/Ajax.NET-Professional/security/advisories/GHSA-5q7q-qqw2-hjq7Mitigation, Third Party Advisory
- https://github.com/michaelschwarz/Ajax.NET-Professional/commit/c89e39b9679fcb8ab6644fe21cc7e652cb615e2bPatch, Third Party Advisory
- https://github.com/michaelschwarz/Ajax.NET-Professional/releases/tag/v21.12.22.1Release Notes, Third Party Advisory
- https://github.com/michaelschwarz/Ajax.NET-Professional/security/advisories/GHSA-5q7q-qqw2-hjq7Mitigation, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.