CVE-2022-4952

HIGH EPSS 49.2%

Published Jul 17, 20232y ago · Modified Jun 17, 20261w ago

7.5 CVSS 3.1

High

Published Jul 17, 2023 2y ago

Last Modified Jun 17, 2026 1w ago

Description

A vulnerability has been found in OmniSharp csharp-language-server-protocol up to 0.19.6 and classified as problematic. This vulnerability affects the function CreateSerializerSettings of the file src/JsonRpc/Serialization/SerializerBase.cs of the component JSON Serializer. The manipulation leads to resource consumption. Upgrading to version 0.19.7 is able to address this issue. The patch is identified as 7fd2219f194a9ef2a8901bb131c5fa12272305ce. It is recommended to upgrade the affected component. VDB-234238 is the identifier assigned to this vulnerability.

CVSS Details

Base Score

7.5

Exploitability

3.9

Impact

3.6

Vector string

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector Network

Attack Complexity Low

Privileges Required None

User Interaction None

Scope Unchanged

Confidentiality None

Integrity None

Availability High

Threat Intelligence

EPSS Exploit Probability

49.2% percentile

Exploit & Patch Status

No Known Exploit

Patch Available

Weaknesses 1

CWE-400 Uncontrolled Resource Consumption Resource Mgmt

Affected Products 1

Vendor	Product	Version	Range
dotnetfoundation	c\#_language_server_protocol	*	<0.19.7

References 5

github.com https://github.com/OmniSharp/csharp-language-server-protocol/commit/7fd2219f194a9ef2a8901bb131c5fa12272305ce

Patch
github.com https://github.com/OmniSharp/csharp-language-server-protocol/pull/902

Patch
github.com https://github.com/OmniSharp/csharp-language-server-protocol/releases/tag/v0.19.7

Release Notes
vuldb.com https://vuldb.com/?ctiid.234238

Permissions Required
vuldb.com https://vuldb.com/?id.234238

Third Party Advisory

Remediation

github.com https://github.com/OmniSharp/csharp-language-server-protocol/commit/7fd2219f194a9ef2a8901bb131c5fa12272305ce

Patch
github.com https://github.com/OmniSharp/csharp-language-server-protocol/pull/902

Patch