What is GHSA-mx3q-j2g2-5qxq?

GHSA-mx3q-j2g2-5qxq is a security advisory published by GitHub Security Advisories with Critical severity. Deserialization of Untrusted Data in NancyFX Nancy

Which CVE IDs does GHSA-mx3q-j2g2-5qxq cover?

GHSA-mx3q-j2g2-5qxq covers the following CVE IDs: CVE-2017-9785. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-mx3q-j2g2-5qxq?

GHSA-mx3q-j2g2-5qxq has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-mx3q-j2g2-5qxq?

GHSA-mx3q-j2g2-5qxq affects 2 products, including: nuget/Nancy:\u003c= 1.4.3; nuget/Nancy:\u003e= 2.0.0-alpha, \u003c= 2.0.0-clinteastwood.

GHSA-mx3q-j2g2-5qxqCriticalCVSS 9.8

Deserialization of Untrusted Data in NancyFX Nancy

Vendor

GitHub Security Advisories

Published

May 17, 2022

Last Modified

January 27, 2023

🔗 CVE IDs covered (1)

CVE-2017-9785 →

📋 Description

Csrf.cs in NancyFX Nancy before 1.4.4 and 2.x before 2.0-dangermouse has Remote Code Execution via Deserialization of JSON data in a CSRF Cookie.

🎯 Affected products2

nuget/Nancy:<= 1.4.3
nuget/Nancy:>= 2.0.0-alpha, <= 2.0.0-clinteastwood

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2017-9785
https://github.com/NancyFx/Nancy/releases/tag/v1.4.4
https://github.com/advisories/GHSA-mx3q-j2g2-5qxq