{"id":"CVE-2024-28698","aliases":["EUVD-2024-2313","GHSA-9xhh-3m78-gvgj"],"status":"published","title":"CLSA Directory Traversal vulnerability","description":"Directory Traversal vulnerability in Marimer LLC CSLA .Net before 8.0 allows a remote attacker to execute arbitrary code via a crafted script to the MobileFormatter component.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.01493,"percentile":0.74366,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2024-07-22T00:00:00Z","modified":"2026-10-28T02:31:12Z","fixes":[{"ecosystem":"NuGet","package":"Csla","fixed_in":["5.5.4","8.0.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"NuGet","package":"Csla","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.4"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Csla","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"last_affected":"6.2.2"},{"fixed":"8.0.0"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Csla","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"last_affected":"7.0.5"},{"fixed":"8.0.0"}]}]},{"source":"osv","ecosystem":"NuGet","package":"Csla","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.4"}]}],"versions":["5.0.0","5.0.0-R19052204","5.0.0-R19080501","5.0.0-R19082107","5.0.0-R19082803","5.0.0-R19090201","5.0.0-R19091001","5.0.0-R19091005","5.0.0-R19091601","5.0.0-R19091701","5.0.1","5.1.0","5.1.0-R19101002","5.1.0-R19110101","5.1.0-R19110701","5.1.0-R19122302","5.1.0-R20011901","5.1.0-R20012001","5.1.0-R20012201","5.1.0-R20020503","5.1.0-R20020701","5.2.0","5.2.0-R20040904","5.2.0-R20042401","5.2.0-R20042901","5.2.0-R20050802","5.3.0","5.3.0-R20062901","5.3.1","5.3.1-R20082601","5.3.2","5.4.0","5.4.0-R20111002","5.4.0-R20111202","5.4.0-R20113004","5.4.1","5.4.1-R21011901","5.4.2","5.4.2-R21040501","5.5.0","5.5.0-R21070101","5.5.0-R21071901","5.5.1","5.5.1-R21080301","5.5.1-R21082202","5.5.2","5.5.2-R21101501","5.5.3"]},{"source":"osv","ecosystem":"NuGet","package":"Csla","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"8.0.0"}]}],"versions":["6.0.0","6.1.0","6.1.0-R22070602","6.2.0","6.2.1","6.2.2","7.0.0","7.0.0-R23042102","7.0.0-R23042601","7.0.0-R23052201","7.0.1","7.0.2","7.0.3","7.0.3-R23113004","7.0.4","7.0.5","7.0.6","7.0.7","8.0.0-R23122103","8.0.0-R24010305","8.0.0-R24012202","8.0.0-R24021201","8.0.0-R24031201","8.0.0-R24031302","8.0.0-R24032503"]},{"source":"osv","ecosystem":"NuGet","package":"Csla","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"8.0.0"}]}],"versions":["7.0.0","7.0.1","7.0.2","7.0.3","7.0.3-R23113004","7.0.4","7.0.5","7.0.6","7.0.7","8.0.0-R23122103","8.0.0-R24010305","8.0.0-R24012202","8.0.0-R24021201","8.0.0-R24031201","8.0.0-R24031302","8.0.0-R24032503"]}],"products":[{"vendor":"marimer","product":"csla.net"}],"references":[{"url":"https://github.com/MarimerLLC/csla/pull/3552","tags":["x_transferred","fix","web"]},{"url":"https://www.intruder.io/research/path-traversal-and-code-execution-in-csla-net-cve-2024-28698","tags":["x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-28698","tags":["advisory"]},{"url":"https://github.com/MarimerLLC/csla/commit/2c32a5748a0a4bb0159285dfad61d4050e890080","tags":["web"]},{"url":"https://github.com/MarimerLLC/csla/commit/445bc609bc117f62cabf49e1462f7a43b0f8f9a2","tags":["web"]},{"url":"https://github.com/MarimerLLC/csla/commit/8fbdd8c773bfeb9ba3e52d91b5a664848629b13a","tags":["web"]},{"url":"https://github.com/MarimerLLC/csla/commit/f3a5c3474974f60ce3c8ffbd5d91c23a1e397ea4","tags":["web"]},{"url":"https://github.com/MarimerLLC/csla/releases/tag/v5.5.4","tags":["web"]},{"url":"https://github.com/advisories/GHSA-9xhh-3m78-gvgj"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/28xxx/CVE-2024-28698.json","tags":["advisory"]},{"url":"https://github.com/MarimerLLC/csla","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-28698","description":"Directory Traversal vulnerability in Marimer LLC CSLA .Net before 8.0 allows a remote attacker to execute arbitrary code via a crafted script to the MobileFormatter component.","status":"published","published":"2024-07-22T00:00:00Z","modified":"2024-08-02T00:56:58.041Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:34:18.951288Z"}],"euvd":[{"id":"EUVD-2024-2313","description":"Directory Traversal vulnerability in Marimer LLC CSLA .Net before 8.0 allows a remote attacker to execute arbitrary code via a crafted script to the MobileFormatter component.","status":"published","published":"2024-07-22T00:00:00Z","modified":"2024-08-02T00:56:58Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T03:50:26.166982Z"}],"ghsa":[{"id":"GHSA-9xhh-3m78-gvgj","title":"CLSA Directory Traversal vulnerability","description":"Directory Traversal vulnerability in Marimer LLC CSLA .Net before 8.0 allows a remote attacker to execute arbitrary code via a crafted script to the MobileFormatter component.\n\nFixes for this issue have been backported to the 5.x, 6.x, and 7.x branches of CSLA. CSLA version 5.5.4 contains a fix. As of time of publication, 6.x and 7.x do not have numbered versions containing the fix but do have fix commits available.","status":"published","published":"2024-07-22T18:31:48Z","modified":"2024-08-15T12:23:01Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:37:59.336921Z"}],"nvd":[{"id":"CVE-2024-28698","description":"Directory Traversal vulnerability in Marimer LLC CSLA .Net before 8.0 allows a remote attacker to execute arbitrary code via a crafted script to the MobileFormatter component.","status":"published","published":"2024-07-22T18:15:03.12Z","modified":"2026-06-17T07:21:39.42Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:10:13.413515Z"}],"osv":[{"id":"CVE-2024-28698","description":"Directory Traversal vulnerability in Marimer LLC CSLA .Net before 8.0 allows a remote attacker to execute arbitrary code via a crafted script to the MobileFormatter component.","status":"published","published":"2024-07-22T00:00:00Z","modified":"2026-10-28T02:31:12.642340518Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:39.569658Z"},{"id":"GHSA-9xhh-3m78-gvgj","title":"CLSA Directory Traversal vulnerability","description":"Directory Traversal vulnerability in Marimer LLC CSLA .Net before 8.0 allows a remote attacker to execute arbitrary code via a crafted script to the MobileFormatter component.\n\nFixes for this issue have been backported to the 5.x, 6.x, and 7.x branches of CSLA. CSLA version 5.5.4 contains a fix. As of time of publication, 6.x and 7.x do not have numbered versions containing the fix but do have fix commits available.","status":"published","published":"2024-07-22T18:31:48Z","modified":"2026-09-10T03:50:17.450492333Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:44.225359Z"}]}}