JetBrains dotPeek before 2018.2 and ReSharper Ultimate before 2018.1.4 allow attackers to execute code by decompiling a compiled .NET object (such as a DLL or EXE file) with a specific file, because of Deserialization of Untrusted Data.
References
Link | Resource |
---|---|
https://blog.jetbrains.com/dotnet/2018/08/02/resharper-ultimate-2018-1-4-rider-2018-1-4-released/ | Patch Vendor Advisory |
https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2018/august/aspnet-resource-files-resx-and-deserialisation-issues/ | Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
No history.
Information
Published : 2018-08-13 17:29
Updated : 2024-02-28 16:48
NVD link : CVE-2018-14878
Mitre link : CVE-2018-14878
CVE.ORG link : CVE-2018-14878
JSON object : View
Products Affected
jetbrains
- resharper_ultimate
- dotpeek
CWE
CWE-502
Deserialization of Untrusted Data