Detections
Analytics

SCA: security update for LiteDB (GHSA-3x49-g6rc-c284)

critical Tenable Self-Hosted Container Security Plugin ID 409753

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - LiteDB is a small, fast and lightweight .NET NoSQL embedded database. Versions prior to 5.0.13 are subject
 to Deserialization of Untrusted Data. LiteDB uses a special field in JSON documents to cast different
 types from `BsonDocument` to POCO classes. When instances of an object are not the same of class,
 `BsonMapper` use a special field `_type` string info with full class name with assembly to be loaded and
 fit into your model. If your end-user can send to your app a plain JSON string, deserialization can load
 an unsafe object to fit into your model. This issue is patched in version 5.0.13 with some basic fixes to
 avoid this, but is not 100% guaranteed when using `Object` type. The next major version will contain an
 allow-list to select what kind of Assembly can be loaded. Workarounds are detailed in the vendor advisory.
 (CVE-2022-23535)

See Also

https://github.com/advisories/GHSA-3x49-g6rc-c284

Plugin Details

Severity: Critical

ID: 409753

Version: Revision 1.10

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.59

Vendor

Vendor Severity: Critical

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2022-23535

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 2/24/2023

Vulnerability Publication Date: 2/24/2023

Reference Information

CVE: CVE-2022-23535

cwe: CWE-502