Vulnerability CVE-2014-8778
Published: 2015-09-16

Description:
Checkmarx CxSAST (formerly CxSuite) before 7.1.8 allows remote authenticated users to bypass the CxQL sandbox protection mechanism and execute arbitrary C# code by asserting the (1) System.Security.Permissions.PermissionState.Unrestricted or (2) System.Security.Permissions.SecurityPermissionFlag.AllFlags permission.

See advisories in our WLB2 database:
Topic
Author
Date
High
Checkmarx CxQL 7.1.5 Sandbox Bypass
Huy-Ngoc DAU
04.09.2015

Type:

CWE-94

 (Improper Control of Generation of Code ('Code Injection'))

CVSS2 => (AV:N/AC:L/Au:S/C:C/I:C/A:C)

CVSS Base Score
Impact Subscore
Exploitability Subscore
9/10
10/10
8/10
Exploit range
Attack complexity
Authentication
Remote
Low
Single time
Confidentiality impact
Integrity impact
Availability impact
Complete
Complete
Complete
Affected software
Checkmarx -> Cxsast 

 References:
http://packetstormsecurity.com/files/133437/Checkmarx-CxQL-7.1.5-Sandbox-Bypass.html
http://seclists.org/fulldisclosure/2015/Sep/17
http://www.securityfocus.com/archive/1/536387/100/0/threaded
Copyright 2024, cxsecurity.com

 

Back to Top