Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS1teDNxLWoyZzItNXF4cc4AAbIQ

Deserialization of Untrusted Data in NancyFX Nancy

Csrf.cs in NancyFX Nancy before 1.4.4 and 2.x before 2.0-dangermouse has Remote Code Execution via Deserialization of JSON data in a CSRF Cookie.

Permalink: https://github.com/advisories/GHSA-mx3q-j2g2-5qxq
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1teDNxLWoyZzItNXF4cc4AAbIQ
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: almost 2 years ago
Updated: about 1 year ago


CVSS Score: 9.8
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Identifiers: GHSA-mx3q-j2g2-5qxq, CVE-2017-9785
References: Repository: https://github.com/NancyFx/Nancy
Blast Radius: 1.0

Affected Packages

nuget:Nancy
Dependent packages: 0
Dependent repositories: 0
Downloads: 13,032,441 total
Affected Version Ranges: >= 2.0.0-alpha, <= 2.0.0-clinteastwood, <= 1.4.3
Fixed in: 2.0.0, 1.4.4
All affected versions: 0.4.0, 0.5.0, 0.6.0, 0.7.0, 0.7.1, 0.8.0, 0.8.1, 0.9.0, 0.10.0, 0.11.0, 0.12.0, 0.12.1, 0.13.0, 0.14.0, 0.14.1, 0.15.0, 0.15.1, 0.15.2, 0.15.3, 0.16.0, 0.16.1, 0.17.0, 0.17.1, 0.18.0, 0.20.0, 0.21.0, 0.21.1, 0.22.0, 0.22.1, 0.22.2, 0.23.0, 0.23.1, 0.23.2, 1.0.0, 1.1.0, 1.2.0, 1.3.0, 1.4.0, 1.4.1, 1.4.2, 1.4.3, 2.0.0-alpha, 2.0.0-barneyrubble, 2.0.0-clienteastwood, 2.0.0-clinteastwood
All unaffected versions: 1.4.4, 1.4.5, 2.0.0