Arbitrary Code Injection Affecting fastreport.opensource Open this link in a new tab package, versions [, 2020.4.0)
Attack Complexity
Low
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications-
snyk-id
SNYK-DOTNET-FASTREPORTOPENSOURCE-1024438
-
published
30 Oct 2020
-
disclosed
30 Oct 2020
-
credit
Unknown
Introduced: 30 Oct 2020
CVE-2020-27998 Open this link in a new tabHow to fix?
Upgrade FastReport.OpenSource
to version 2020.4.0 or higher.
Overview
FastReport.OpenSource is a reporting solution for .Net Core 2.x and .Net Framework 4.x. Various report objects will allow your report to look exactly how you want it to: 13 types of bands, 25 types of barcodes, table object, shapes, line, PolyLine, Polygon and many more.
Affected versions of this package are vulnerable to Arbitrary Code Injection. It lacks a ScriptSecurity feature and therefore may mishandle (for example) GetType
, typeof
, TypeOf
, DllImport
, LoadLibrary
, and GetProcAddress
.