CVE-2021-23758

HIGH

All versions of package ajaxpro.2 are vulnerable to Deserialization of Untrusted Data due to the possibility of deserialization of arbitrary .NET classes, which can be abused to gain remote code execution.

CVSS v3.1 Score

8.1
HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
NETWORK
Complexity
HIGH
Privileges
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH
Published: 12/3/2021Modified: 8/27/2026

Related Intelligence (0)

No articles currently reference this CVE.

References (8)

http://packetstormsecurity.com/files/175677/AjaxPro-Deserialization-Remote-Code-Execution.htmlExploitVDB Entryhttps://github.com/michaelschwarz/Ajax.NET-Professional/commit/b0e63be5f0bb20dfce507cb8a1a9568f6e73de57PatchThird Party Advisoryhttps://snyk.io/vuln/SNYK-DOTNET-AJAXPRO2-1925971Third Party Advisoryhttp://packetstormsecurity.com/files/175677/AjaxPro-Deserialization-Remote-Code-Execution.htmlExploitVDB Entryhttps://github.com/michaelschwarz/Ajax.NET-Professional/commit/b0e63be5f0bb20dfce507cb8a1a9568f6e73de57PatchThird Party Advisoryhttps://snyk.io/vuln/SNYK-DOTNET-AJAXPRO2-1925971Third Party Advisoryhttps://blog.talosintelligence.com/uat-10147-chinese-speaking-adversary-integrates-agentic-ai-into-post-compromise-operations/ExploitThird Party Advisoryhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-23758US Government Resource