CVE-2021-43853
High
Description
Ajax.NET Professional (AjaxPro) is an AJAX framework available for Microsoft ASP.NET. Affected versions of this package are vulnerable to JavaScript object injection which may result in cross site scripting when leveraged by a malicious user. The affected core relates to JavaScript object creation when parsing json input. Releases before version 21.12.22.1 are affected. A workaround exists that replaces one of the core JavaScript files embedded in the library. See the GHSA-5q7q-qqw2-hjq7 for workaround details.
SeverityHigh
CVSS8.7
Exploit probability—
Product
Ajax.net Professional
PublishedDec 22, 2021
First seenDec 22, 2021
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- ajax.net_professional_project ajax.net_professional21.12.22.1 or later
- AjaxNetProfessional21.12.22.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ajax.net_professional_project ajax.net_professional | v < 21.12.22.1 | 21.12.22.1 |
| AjaxNetProfessionalNuGet | v < 21.12.22.1 | 21.12.22.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.