PT-2024-36622 · Syncfusion · Syncfusion Essential Studio For Asp.Net Mvc

Published 2024-12-15 · Updated 2024-12-16 · CVE-2024-55969

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Syncfusion Essential Studio for ASP.NET MVC versions prior to 27.1.55

Description The issue occurs when resaving a DOCX document with an external reference XML, resulting in an XMLException. This problem is present in the DocIO feature of Syncfusion Essential Studio for ASP.NET MVC.

Recommendations For versions prior to 27.1.55, update to version 27.1.55 or later to resolve the issue. As a temporary workaround, consider avoiding the resaving of DOCX documents with external reference XML until a patch is available. Restrict access to the DocIO feature to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2024-55969

Affected Products

Syncfusion Essential Studio For Asp.Net Mvc

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-55969 · Security Note
• https://t.me/cvedetector/12951 · Telegram Post
• https://twitter.com/CVEnew/status/1868271092114018738 · Twitter Post
• https://ej2.syncfusion.com/aspnetmvc/documentation/release-notes/27.1.55?type=all · Note
• https://t.me/cvenotify/104404 · Telegram Post
• https://t.me/cvenotify/104328 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1868156615016223047 · Twitter Post