CVE-2025-66631

Katalog CVE

CVSS 9.8 · Critical EPSS 0,67%

Kerentanan Deserialization of Untrusted Data pada cslanet csla .net. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

CSLA .NET is a framework designed for the development of reusable, object-oriented business layers for applications. Versions 5.5.4 and below allow the use of WcfProxy. WcfProxy uses the now-obsolete NetDataContractSerializer (NDCS) and is vulnerable to remote code execution during deserialization. This vulnerability is fixed in version 6.0.0. To workaround this issue, remove the WcfProxy in data portal configurations.

Rincian

Terbit di NVD

9 Desember 2025

Terakhir diubah

7 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-502: Deserialization of Untrusted Data

EPSS (30 hari)

0,67% peluang dieksploitasi; lebih tinggi dari 50,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/MarimerLLC/csla/security/advisories/GHSA-wq34-7f4g-953v mitigasi · advisory vendor
• https://github.com/MarimerLLC/csla/pull/4018 issue tracking · patch
• https://github.com/MarimerLLC/csla/issues/4001 issue tracking