Vulnerability · Published Dec 4, 2023 · Assigned by GitHub_M
CVE-2023-49289Cross-site Scripting in Ajax.NET Professional
Medium 6.3
In plain English
A medium-severity cross-site scripting in Ajax.NET-Professional from michaelschwarz. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Ajax.NET Professional (AjaxPro) is an AJAX framework for Microsoft ASP.NET which will create proxy JavaScript classes that are used on client-side to invoke methods on the web server. Affected versions of this package are vulnerable cross site scripting attacks. Releases before version 21.12.22.1 are affected. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| NuGet | ajaxnetprofessional | 21.12.22.1 | GHSA-8v6j-gc74-fmpp |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| michaelschwarz | Ajax.NET-Professional | < 21.12.22.1 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
References
- https://github.com/michaelschwarz/Ajax.NET-Professional/security/advisories/GHSA-8v6j-gc74-fmpp x_refsource_CONFIRM
- https://github.com/michaelschwarz/Ajax.NET-Professional/commit/c89e39b9679fcb8ab6644fe21cc7e652cb615e2b x_refsource_MISC
- https://www.nuget.org/packages/AjaxNetProfessional/ x_refsource_MISC