CVE-2021-43853 : Ajax.NET Professional (AjaxPro) is an AJAX framework available for Microsoft ASP

Ajax.NET Professional (AjaxPro) is an AJAX framework available for Microsoft ASP.NET. Affected versions of this package are vulnerable to JavaScript object injection which may result in cross site scripting when leveraged by a malicious user. The affected core relates to JavaScript object creation when parsing json input. Releases before version 21.12.22.1 are affected. A workaround exists that replaces one of the core JavaScript files embedded in the library. See the GHSA-5q7q-qqw2-hjq7 for workaround details.

Published 2021-12-22 21:15:08

Updated 2022-08-09 13:28:26

Source GitHub, Inc.

View at NVD, CVE.org

Vulnerability category: Cross site scripting (XSS)

Products affected by CVE-2021-43853

Ajax.net Professional Project » Ajax.net Professional
Versions before (<) 21.12.22.1
cpe:2.3:a:ajax.net_professional_project:ajax.net_professional:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2021-43853

EPSS FAQ

0.07%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 29 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2021-43853

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
3.5	LOW	AV:N/AC:M/Au:S/C:N/I:P/A:N	6.8	2.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: Single Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None
5.4	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N	2.3	2.7	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: Required Scope: Changed Confidentiality: Low Integrity: Low Availability: None
8.7	HIGH	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N	2.3	5.8	GitHub, Inc.
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: Required Scope: Changed Confidentiality: High Integrity: High Availability: None

CWE ids for CVE-2021-43853

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Assigned by: security-advisories@github.com (Secondary)
CWE-502 Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2021-43853

https://github.com/michaelschwarz/Ajax.NET-Professional/commit/c89e39b9679fcb8ab6644fe21cc7e652cb615e2b

fixed another XSS issue · michaelschwarz/Ajax.NET-Professional@c89e39b · GitHub
Patch;Third Party Advisory

CVEs referencing this url
https://github.com/michaelschwarz/Ajax.NET-Professional/security/advisories/GHSA-5q7q-qqw2-hjq7

Cross-Site Scripting Security Vulnerability · Advisory · michaelschwarz/Ajax.NET-Professional · GitHub
Mitigation;Third Party Advisory
https://github.com/michaelschwarz/Ajax.NET-Professional/releases/tag/v21.12.22.1

Release v21.12.22.1 · michaelschwarz/Ajax.NET-Professional · GitHub
Release Notes;Third Party Advisory

Jump to

Vulnerability Details : CVE-2021-43853

Products affected by CVE-2021-43853

Exploit prediction scoring system (EPSS) score for CVE-2021-43853

CVSS scores for CVE-2021-43853

CWE ids for CVE-2021-43853

References for CVE-2021-43853