CVE-2021-27568

Common vulnerabilities & exposures (CVE)

CVE database CVE database blogpost Release & EoL database

Published at: - 23-02-2021 03:15

Last modified: - 12-05-2022 04:34

Total changes: - 10

Description

An issue was discovered in netplex json-smart-v1 through 2015-10-23 and json-smart-v2 through 2.4. An exception is thrown from a function, but it is not caught, as demonstrated by NumberFormatException. When it is not caught, it may cause programs using the library to crash or expose sensitive information.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Low

Attack complexity

Network

Attack vector

High

Availability

High

Confidentiality

None

Integrity

None

Privileges required

Unchanged

Scope

None

User interaction

9.1

Base score

3.9

5.2

Exploitability score

Impact score

Verification logic

vendor=json-smart_project AND product=json-smart-v1 AND versionEndExcluding=1.3.2

vendor=json-smart_project AND product=json-smart-v2 AND versionEndExcluding=2.3.1

vendor=json-smart_project AND product=json-smart-v2 AND versionStartIncluding=2.4 AND versionEndExcluding=2.4.1

vendor=oracle AND product=weblogic_server AND version=12.2.1.3.0

vendor=oracle AND product=utilities_framework AND version=4.4.0.0.0

vendor=oracle AND product=weblogic_server AND version=12.2.1.4.0

vendor=oracle AND product=peoplesoft_enterprise_peopletools AND version=8.58

vendor=oracle AND product=weblogic_server AND version=14.1.1.0.0

vendor=oracle AND product=utilities_framework AND version=4.4.0.2.0

vendor=oracle AND product=peoplesoft_enterprise_peopletools AND version=8.59

vendor=oracle AND product=utilities_framework AND version=4.4.0.3.0

vendor=oracle AND product=communications_cloud_native_core_policy AND version=1.14.0

vendor=oracle AND product=oss_support_tools AND versionEndExcluding=2.12.42

Reference

https://github.com/netplex/json-smart-v2/issues/60
https://github.com/netplex/json-smart-v1/issues/7
[druid-commits] 20210712 [GitHub] [druid] zachjsh opened a new pull request #11438: Suppress CVE-2021-27568 from json-smart 2.3 dependency-Mailing List, Third Party Advisory
[druid-commits] 20210712 [druid] branch master updated: Suppress CVE-2021-27568 from json-smart 2.3 dependency (#11438)-Mailing List, Patch, Third Party Advisory
[druid-commits] 20210712 [GitHub] [druid] zachjsh merged pull request #11438: Suppress CVE-2021-27568 from json-smart 2.3 dependency-Mailing List, Third Party Advisory
N/A-Patch, Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2022.html
https://www.oracle.com/security-alerts/cpuapr2022.html

Keywords

CVE-2021-27568

Common vulnerabilities & exposures (CVE)

Description

Common Vulnerability Scoring System (CVSS)

Verification logic

Reference

NVD

CVE-2021-27568

CVE

Common vulnerabilities & exposures

CVSS

Common vulnerability scoring system

Security

Vulnerabilities

Exposures