| Package | Affected versions | Patched versions |
|---|---|---|
| mirasys vms | ≥ 8.0.0, < 8.3.2< 7.6.1 | 8.3.27.6.1 |
Mirasys VMS before V7.6.1 and 8.x before V8.3.2 mishandles the Mirasys.Common.Utils.Security.DataCrypt method in Common.dll in AuditTrailService in SMServer.exe. This method triggers insecure deserialization within the .NET garbage collector, in which a gadget (contained in a serialized object) may be executed with SYSTEM privileges. The attacker must properly encrypt the object; however, the hardcoded keys are available.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free