What’s Vulnerable › Vulnerabilities

CVE-2018-20221

• Severity: high (CVSS 8.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 10.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-03-21 · updated 2026-06-17
• Weakness: CWE-502

Description

Secure/SAService.rem in Deltek Ajera Timesheets 9.10.16 and prior are vulnerable to remote code execution via deserialization of untrusted user input from an authenticated user. The executed code will run as the IIS Application Pool that is running the application.

Affected products

• Deltek Ajera: through 9.10.16

References

• http://packetstormsecurity.com/files/151035/Ajera-Timesheets-9.10.16-Deserialization.html
• https://www.exploit-db.com/exploits/46086/
• http://packetstormsecurity.com/files/151035/Ajera-Timesheets-9.10.16-Deserialization.html
• https://www.exploit-db.com/exploits/46086/

Get alerted when CVE-2018-20221 or the next vulnerability affects your stack