Deserialization of untrusted data

2020-12-1419:15:00

PRIOn knowledge base

www.prio-n.com

9.4 High

AI Score

Confidence

High

0.008 Low

EPSS

Percentile

81.7%

JSON

QuantConnect Lean versions from 2.3.0.0 to 2.4.0.1 are affected by an insecure deserialization vulnerability due to insecure configuration of TypeNameHandling property in Json.NET library.

CPENameOperatorVersion
leange2.3.0.0
leanle2.4.0.1

CPE	Name	Operator	Version
	lean	ge	2.3.0.0
	lean	le	2.4.0.1

References

github.com/QuantConnect/Lean/issues/3537