GHSA-w65q-jcmv-28gj

ghsaUSosv

Dynamic Linq vulnerable to remote code execution

view advisory published 2023-06-22Licence: CC-BY-4.0

Dynamic Linq 1.0.7.10 through 1.2.25 before 1.3.0 allows attackers to execute arbitrary code and commands when untrusted input to methods including Where, Select, OrderBy is parsed.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2023-32571US	critical9.8	34.9% (98th)	Exploit	2023-06-22
Dynamic Linq 1.0.7.10 through 1.2.25 before 1.3.0 allows attackers to execute arbitrary code and commands when untrusted input to methods including Where, Select, OrderBy is parsed…

references

External citations — patches, advisories, analysis.

https://github.com/zzzprojects/System.Linq.Dynamic.CorePACKAGE
https://nvd.nist.gov/vuln/detail/CVE-2023-32571ADVISORY
https://research.nccgroup.com/2023/06/13/dynamic-linq-injection-remote-code-execution-vulnerability-cve-2023-32571WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan