PT-2023-27072 · Unknown · Hjson-Java

Lopezalvaro · Publicado 2023-09-01 · Atualizado 2023-09-06 · CVE-2023-39685

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions hjson-java versions up to v3.0.0

Description The issue allows attackers to cause a Denial of Service (DoS) via supplying a crafted JSON string. This can lead to a StringIndexOutOfBoundsException.

Recommendations For hjson-java versions up to v3.0.0, consider updating to a version later than v3.0.0 to resolve the issue. As a temporary workaround, restrict the input of JSON strings to prevent crafted strings from being processed.

Exploit

Correção

Out of bounds Read

Code Injection

Enumeração de Fraquezas

CWE-125

CWE-94

Identificadores relacionados

CVE-2023-39685

GHSA-94W5-RF69-2H6C

Produtos afetados

Hjson-Java

Referências · 7

• 🔥 https://github.com/hjson/hjson-java/issues/27 · Exploit
• https://github.com/hjson/hjson-java · Nota
• https://github.com/hjson/hjson-java/commit/aff0b607929b4397d93dc0d029a56aeefb242602 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-39685 · Nota de Segurança
• https://t.me/cibsecurity/69638 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-39685 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-94w5-rf69-2h6c · Aviso do Fabricante