CVE-2022-0749

Deserialization of Untrusted Data

High · published March 17, 2022

CVSS v3.1
7.4
EPSS
2%
Percentile
77.3
In the wild
Unconfirmed
What it is

This affects all versions of package SinGooCMS.Utility. The socket client in the package can pass in the payload via the user-controllable input after it has been established, because this socket client transmission does not have the appropriate restrictions or type bindings for the BinaryFormatter.

The record
Technical detail
CVSS v3.1
7.4 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H/E:P
CVSS v4.0
Not supplied
EPSS
0.01722 · 77.3th percentile
Published
2022-03-17T11:20Z
EPSS history
Timeline
  • 17 MAR 11:20Z
    Deserialization of Untrusted Data
    cvelistv5