CVE-2021-23900

OWASP json-sanitizer before 1.2.2 can output invalid JSON or throw an undeclared exception for crafted input. This may lead to denial of service if the application is not prepared to handle these situations.

CVSS v3 7.5 HIGH
CVSS v2.0 5.0 MEDIUM

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:N/I:N/A:P

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References

Link	Resource
https://github.com/OWASP/json-sanitizer/commit/a37f594f7378a1c76b3283e0dab9e1ab1dc0247e	Patch Third Party Advisory
https://github.com/OWASP/json-sanitizer/compare/v1.2.1...v1.2.2	Patch Third Party Advisory
https://groups.google.com/g/json-sanitizer-support/c/dAW1AeNMoA0	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:owasp:json-sanitizer:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2021-01-13 16:15

Updated : 2021-01-19 19:00

NVD link : CVE-2021-23900

Mitre link : CVE-2021-23900

CVE.ORG link : CVE-2021-23900

JSON object : View

Products Affected

owasp

json-sanitizer

CWE

NVD-CWE-noinfo

{"id": "CVE-2021-23900", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2021-01-13T16:15:14.490", "references": [{"url": "https://github.com/OWASP/json-sanitizer/commit/a37f594f7378a1c76b3283e0dab9e1ab1dc0247e", "tags": ["Patch", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/OWASP/json-sanitizer/compare/v1.2.1...v1.2.2", "tags": ["Patch", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://groups.google.com/g/json-sanitizer-support/c/dAW1AeNMoA0", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "OWASP json-sanitizer before 1.2.2 can output invalid JSON or throw an undeclared exception for crafted input. This may lead to denial of service if the application is not prepared to handle these situations."}, {"lang": "es", "value": "OWASP json-sanitizer versiones anteriores a 1.2.2, puede generar JSON no v\u00e1lido o lanzar una excepci\u00f3n no declarada para una entrada dise\u00f1ada. Esto puede conllevar a una denegaci\u00f3n del servicio si la aplicaci\u00f3n no est\u00e1 preparada para manejar estas situaciones."}], "lastModified": "2021-01-19T19:00:48.250", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:owasp:json-sanitizer:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C22C77CE-0FF1-474E-B921-438980F66C82", "versionEndExcluding": "1.2.2"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}