CVE-2017-9785 Deserialization of Untrusted Data in NancyFX Nancy
CriticalCVSS 9.8
EPSS 3.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Csrf.cs in NancyFX Nancy before 1.4.4 and 2.x before 2.0-dangermouse has Remote Code Execution via Deserialization of JSON data in a CSRF Cookie.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| nuget Nancy(NuGet) | <= 1.4.3 | No fix listed |
| nuget Nancy(NuGet) | >= 2.0.0-alpha, <= 2.0.0-clinteastwood | No fix listed |
| nuget Nancy(NuGet) | < 1.4.4 | 1.4.4 |
| nuget Nancy(NuGet) | = 0.10.0 | No fix listed |
| nuget Nancy(NuGet) | = 0.11.0 | No fix listed |
| nuget Nancy(NuGet) | = 0.12.0 | No fix listed |
| nuget Nancy(NuGet) | = 0.12.1 | No fix listed |
| nuget Nancy(NuGet) | = 0.13.0 | No fix listed |
| nuget Nancy(NuGet) | = 0.14.0 | No fix listed |
| nuget Nancy(NuGet) | = 0.14.1 | No fix listed |
| nuget Nancy(NuGet) | = 0.15.0 | No fix listed |
| nuget Nancy(NuGet) | = 0.15.1 | No fix listed |
| nuget Nancy(NuGet) | = 0.15.2 | No fix listed |
| nuget Nancy(NuGet) | = 0.15.3 | No fix listed |
| nuget Nancy(NuGet) | = 0.16.0 | No fix listed |
| nuget Nancy(NuGet) | = 0.16.1 | No fix listed |
| nuget Nancy(NuGet) | = 0.17.0 | No fix listed |
| nuget Nancy(NuGet) | = 0.17.1 | No fix listed |
| nuget Nancy(NuGet) | = 0.18.0 | No fix listed |
| nuget Nancy(NuGet) | = 0.20.0 | No fix listed |
| nuget Nancy(NuGet) | = 0.21.0 | No fix listed |
| nuget Nancy(NuGet) | = 0.21.1 | No fix listed |
| nuget Nancy(NuGet) | = 0.22.0 | No fix listed |
| nuget Nancy(NuGet) | = 0.22.1 | No fix listed |
| nuget Nancy(NuGet) | = 0.22.2 | No fix listed |
Show 29 more
| Product | Affected versions | Fixed in |
|---|---|---|
| nuget Nancy(NuGet) | = 0.23.0 | No fix listed |
| nuget Nancy(NuGet) | = 0.23.1 | No fix listed |
| nuget Nancy(NuGet) | = 0.23.2 | No fix listed |
| nuget Nancy(NuGet) | = 0.4.0 | No fix listed |
| nuget Nancy(NuGet) | = 0.5.0 | No fix listed |
| nuget Nancy(NuGet) | = 0.6.0 | No fix listed |
| nuget Nancy(NuGet) | = 0.7.0 | No fix listed |
| nuget Nancy(NuGet) | = 0.7.1 | No fix listed |
| nuget Nancy(NuGet) | = 0.8.0 | No fix listed |
| nuget Nancy(NuGet) | = 0.8.1 | No fix listed |
| nuget Nancy(NuGet) | = 0.9.0 | No fix listed |
| nuget Nancy(NuGet) | = 1.0.0 | No fix listed |
| nuget Nancy(NuGet) | = 1.1.0 | No fix listed |
| nuget Nancy(NuGet) | = 1.2.0 | No fix listed |
| nuget Nancy(NuGet) | = 1.3.0 | No fix listed |
| nuget Nancy(NuGet) | = 1.4.0 | No fix listed |
| nuget Nancy(NuGet) | = 1.4.1 | No fix listed |
| nuget Nancy(NuGet) | = 1.4.2 | No fix listed |
| nuget Nancy(NuGet) | = 1.4.3 | No fix listed |
| nuget Nancy(NuGet) | >= 2.0.0-alpha, < 2.0.0 | 2.0.0 |
| nuget Nancy(NuGet) | = 2.0.0-alpha | No fix listed |
| nuget Nancy(NuGet) | = 2.0.0-barneyrubble | No fix listed |
| nuget Nancy(NuGet) | = 2.0.0-clienteastwood | No fix listed |
| nuget Nancy(NuGet) | = 2.0.0-clinteastwood | No fix listed |
| nancyfx nancy | <= 1.4.3 | No fix listed |
| nancyfx nancy | = 2.0.0-alpha | No fix listed |
| nancyfx nancy | = 2.0.0-barneyrubble | No fix listed |
| nancyfx nancy | = 2.0.0-clinteastwood | No fix listed |
| NancyFX Framework Up to 2.0.0 | = NancyFX Framework Up to 2.0.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com release-notes third-party-advisory
- github.com