High severity · published Jan 13, 2021
CVE-2021-23900
OWASP json-sanitizer before 1.2.2 can output invalid JSON or throw an undeclared exception for crafted input
7.5
CVSS
2.1%
EPSS
No
On KEV
Description
OWASP json-sanitizer before 1.2.2 can output invalid JSON or throw an undeclared exception for crafted input. This may lead to denial of service if the application is not prepared to handle these situations.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.1% · higher than 82% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JS
Json-sanitizer · Owasp
before 1.2.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-23900
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-23900
Patch
https://github.com/OWASP/json-sanitizer/commit/a37f594f7378a1c76b3283e0dab9e1ab1dc0247e
Patch
https://github.com/OWASP/json-sanitizer/compare/v1.2.1...v1.2.2
Third Party Advisory
https://groups.google.com/g/json-sanitizer-support/c/dAW1AeNMoA0
More from Json-sanitizer
9.8
CVE-2021-23899
OWASP json-sanitizer before 1.2.2 may emit closing SCRIPT tags and CDATA section delimiters for crafted input
6.1
CVE-2020-13973
OWASP json-sanitizer before 1.2.1 allows XSS