CVE-2014-8778 Checkmarx CxSAST (formerly CxSuite) before 7.1.8 allows remote authenticated users to bypass the CxQL sandbox protection mechanism and execute arbitrary C# code by asserting the (1) System.Security.Pe...
HighCVSS 9.0
EPSS 3.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Checkmarx CxSAST (formerly CxSuite) before 7.1.8 allows remote authenticated users to bypass the CxQL sandbox protection mechanism and execute arbitrary C# code by asserting the (1) System.Security.Permissions.PermissionState.Unrestricted or (2) System.Security.Permissions.SecurityPermissionFlag.AllFlags permission.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Checkmarx cxsast | <= 7.1.6 | No fix listed |
References
- packetstormsecurity.com
- 20150907 Checkmarx CxQL Sandbox bypass (CVE-2014-8778) exploit mailing-list
- 20150903 Checkmarx CxQL Sandbox bypass (CVE-2014-8778) mailing-list