CVE-2024-28698
CLSA Directory Traversal vulnerability
Directory Traversal vulnerability in Marimer LLC CSLA .Net before 8.0 allows a remote attacker to execute arbitrary code via a crafted script to the MobileFormatter component.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Directory Traversal vulnerability in Marimer LLC CSLA .Net before 8.0 allows a remote attacker to execute arbitrary code via a crafted script to the MobileFormatter component.
- Record
CVE-2024-28698- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-22
- Updated
- 2026-11-02
EUVDEUVD-2024-2313
Directory Traversal vulnerability in Marimer LLC CSLA .Net before 8.0 allows a remote attacker to execute arbitrary code via a crafted script to the MobileFormatter component.
- Record
EUVD-2024-2313- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9xhh-3m78-gvgj
CLSA Directory Traversal vulnerability
Directory Traversal vulnerability in Marimer LLC CSLA .Net before 8.0 allows a remote attacker to execute arbitrary code via a crafted script to the MobileFormatter component.
Fixes for this issue have been backported to the 5.x, 6.x, and 7.x branches of CSLA. CSLA version 5.5.4 contains a fix. As of time of publication, 6.x and 7.x do not have numbered versions containing the fix but do have fix commits available.
- Record
GHSA-9xhh-3m78-gvgj- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-22
- Updated
- 2026-11-02
NVD
Directory Traversal vulnerability in Marimer LLC CSLA .Net before 8.0 allows a remote attacker to execute arbitrary code via a crafted script to the MobileFormatter component.
- Record
CVE-2024-28698- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-22
- Updated
- 2026-11-02
OSV
Directory Traversal vulnerability in Marimer LLC CSLA .Net before 8.0 allows a remote attacker to execute arbitrary code via a crafted script to the MobileFormatter component.
- Record
CVE-2024-28698- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-9xhh-3m78-gvgj
CLSA Directory Traversal vulnerability
Directory Traversal vulnerability in Marimer LLC CSLA .Net before 8.0 allows a remote attacker to execute arbitrary code via a crafted script to the MobileFormatter component.
Fixes for this issue have been backported to the 5.x, 6.x, and 7.x branches of CSLA. CSLA version 5.5.4 contains a fix. As of time of publication, 6.x and 7.x do not have numbered versions containing the fix but do have fix commits available.
- Record
GHSA-9xhh-3m78-gvgj- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-22
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
CslaNuGet |
before 5.5.4 | 5.5.4 |
CslaNuGet |
6.0.0 to 6.2.2 | 8.0.0 |
CslaNuGet |
7.0.0 to 7.0.5 | 8.0.0 |
CslaNuGet |
before 5.5.4, plus listed versions 5.0.05.0.0-R190522045.0.0-R190805015.0.0-R190821075.0.0-R19082803 Show 43 moreShow less5.0.0-R190902015.0.0-R190910015.0.0-R190910055.0.0-R190916015.0.0-R190917015.0.15.1.05.1.0-R191010025.1.0-R191101015.1.0-R191107015.1.0-R191223025.1.0-R200119015.1.0-R200120015.1.0-R200122015.1.0-R200205035.1.0-R200207015.2.05.2.0-R200409045.2.0-R200424015.2.0-R200429015.2.0-R200508025.3.05.3.0-R200629015.3.15.3.1-R200826015.3.25.4.05.4.0-R201110025.4.0-R201112025.4.0-R201130045.4.15.4.1-R210119015.4.25.4.2-R210405015.5.05.5.0-R210701015.5.0-R210719015.5.15.5.1-R210803015.5.1-R210822025.5.25.5.2-R211015015.5.3 |
5.5.4 |
CslaNuGet |
6.0.0 up to 8.0.0, plus listed versions 6.1.06.1.0-R220706026.2.06.2.16.2.2 Show 19 moreShow less7.0.07.0.0-R230421027.0.0-R230426017.0.0-R230522017.0.17.0.27.0.37.0.3-R231130047.0.47.0.57.0.67.0.78.0.0-R231221038.0.0-R240103058.0.0-R240122028.0.0-R240212018.0.0-R240312018.0.0-R240313028.0.0-R24032503 |
8.0.0 |
CslaNuGet |
7.0.0 up to 8.0.0, plus listed versions 7.0.17.0.27.0.37.0.3-R231130047.0.4 Show 10 moreShow less7.0.57.0.67.0.78.0.0-R231221038.0.0-R240103058.0.0-R240122028.0.0-R240212018.0.0-R240312018.0.0-R240313028.0.0-R24032503 |
8.0.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-28698 is a critical vulnerability (CVSS 9.8) in Marimer Csla.net, published July 22, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.49%, the 74th percentile. Fixed in Csla 5.5.4.
References
github.com/MarimerLLC/csla/pull/3552
intruder.io/research/path-traversal-and-code-execution-in-csla-net-cve-2024-28698
nvd.nist.gov/vuln/detail/CVE-2024-28698