Medium severity · published Dec 5, 2023
CVE-2023-49289
Ajax.NET Professional (AjaxPro) is an AJAX framework for Microsoft ASP.NET which will create proxy JavaScript classes that are used on client-side to invoke methods on the web…
5.4
CVSS
0.6%
EPSS
No
On KEV
Description
Ajax.NET Professional (AjaxPro) is an AJAX framework for Microsoft ASP.NET which will create proxy JavaScript classes that are used on client-side to invoke methods on the web server. Affected versions of this package are vulnerable cross site scripting attacks. Releases before version 21.12.22.1 are affected. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 50% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AP
Ajax.net Professional · Michaelschwarz
before 21.12.22.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-49289
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-49289
Patch
https://github.com/michaelschwarz/Ajax.NET-Professional/commit/c89e39b9679fcb8ab6644fe21cc7e652cb615e2b
Vendor Advisory
https://github.com/michaelschwarz/Ajax.NET-Professional/security/advisories/GHSA-8v6j-gc74-fmpp
Product
https://www.nuget.org/packages/AjaxNetProfessional/
More from Ajax.net Professional
9.8
CVE-2021-23758
Deserialization of Untrusted Data