Vulnerability Details : CVE-2021-23900
OWASP json-sanitizer before 1.2.2 can output invalid JSON or throw an undeclared exception for crafted input. This may lead to denial of service if the application is not prepared to handle these situations.
Vulnerability category: Denial of service
Products affected by CVE-2021-23900
- cpe:2.3:a:owasp:json-sanitizer:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2021-23900
0.18%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 55 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2021-23900
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:N/I:N/A:P |
10.0
|
2.9
|
NIST | |
7.5
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
3.9
|
3.6
|
NIST |
References for CVE-2021-23900
-
https://groups.google.com/g/json-sanitizer-support/c/dAW1AeNMoA0
com.mikesamuel:json-sanitizer versions < 1.2.2 vulnerable.Third Party Advisory
-
https://github.com/OWASP/json-sanitizer/compare/v1.2.1...v1.2.2
Comparing v1.2.1...v1.2.2 · OWASP/json-sanitizer · GitHubPatch;Third Party Advisory
-
https://github.com/OWASP/json-sanitizer/commit/a37f594f7378a1c76b3283e0dab9e1ab1dc0247e
Tests for fixes for previously undisclosed vulnerabilities · OWASP/json-sanitizer@a37f594 · GitHubPatch;Third Party Advisory
Jump to