CVE-2022-45688 (High) detected in json-20201115.jar #309
Description
CVE-2022-45688 - High Severity Vulnerability
Vulnerable Library - json-20201115.jar
JSON is a light-weight, language independent, data interchange format. See http://www.JSON.org/
The files in this package implement JSON encoders/decoders in Java.
It also includes the capability to convert between JSON and XML, HTTP
headers, Cookies, and CDL.
This is a reference implementation. There is a large number of JSON packages
in Java. Perhaps someday the Java community will standardize on one. Until
then, choose carefully.
The license includes this restriction: "The software shall be used for good,
not evil." If your conscience cannot live with that, then choose a different
package.</p>
Library home page: https://github.com/douglascrockford/JSON-java
Path to dependency file: /codecheck/build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.json/json/20201115/f8e7a9953822c90e0701c3cd50764b5e9063f85c/json-20201115.jar
Dependency Hierarchy:
- spotbugs-4.2.1.jar (Root Library)
- ❌ json-20201115.jar (Vulnerable Library)
Found in base branch: master
Vulnerability Details
A stack overflow in the XML.toJSONObject component of hutool-json v5.8.10 allows attackers to cause a Denial of Service (DoS) via crafted JSON or XML data.
Publish Date: 2022-12-13
URL: CVE-2022-45688
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: GHSA-3vqj-43w4-2q58
Release Date: 2022-12-13
Fix Resolution (org.json:json): 20230227
Direct dependency fix Resolution (com.github.spotbugs:spotbugs): 4.2.2
Step up your Open Source Security Game with Mend here