CVE-2025-3424CWE-22

3.2.1 Arbitrary File Read in insecure .NET Remoting TCP Channel

High · published April 7, 2025

CVSS v4.0
7.7
EPSS
0%
Percentile
14.7
In the wild
Unconfirmed
What it is

The IntelliSpace portal application utilizes .NET

Remoting for its functionality. The vulnerability arises from the exploitation

of port 755 through the "Object Marshalling" technique, which allows

an attacker to read internal files without any authentication. This is possible

by crafting specific .NET Remoting URLs derived from information enumerated in

the client-side configuration files.

This issue affects IntelliSpace Portal: 12 and prior.

The record
Technical detail
CVSS v4.0
7.7 · HIGH
Vector
CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/S:P/AU:Y/R:U/V:C/RE:M/U:Green
EPSS
0.00244 · 14.7th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2025-04-07T15:36Z
EPSS history
Timeline
  • 07 APR 15:36Z
    3.2.1 Arbitrary File Read in insecure .NET Remoting TCP Channel
    cvelistv5