Medium severity · published Feb 23, 2021
CVE-2021-27568
An issue was discovered in netplex json-smart-v1 through 2015-10-23 and json-smart-v2 through 2.4
5.9
CVSS
2.9%
EPSS
No
On KEV
Description
An issue was discovered in netplex json-smart-v1 through 2015-10-23 and json-smart-v2 through 2.4. An exception is thrown from a function, but it is not caught, as demonstrated by NumberFormatException. When it is not caught, it may cause programs using the library to crash or expose sensitive information.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.9% · higher than 87% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WS
WebLogic Server · Oracle
12.2.1.3.0; 12.2.1.4.0; 14.1.1.0.0 · source: NVD
CC
Communications Cloud Native Core Policy · Oracle
1.14.0 · source: NVD
JS
Json-smart-v1 · Json-smart Project
before 1.3.2 · source: NVD
JS
Json-smart-v2 · Json-smart Project
before 2.3.1; 2.4 before 2.4.1 · source: NVD
OS
Oss Support Tools · Oracle
before 2.12.42 · source: NVD
PE
Peoplesoft Enterprise Peopletools · Oracle
8.58; 8.59 · source: NVD
UF
Utilities Framework · Oracle
4.4.0.0.0; 4.4.0.2.0; 4.4.0.3.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-27568
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-27568
Exploit
https://github.com/netplex/json-smart-v1/issues/7
Exploit
https://github.com/netplex/json-smart-v2/issues/60
lists.apache.org
https://lists.apache.org/thread.html/rb6287f5aa628c8d9af52b5401ec6cc51b6fc28ab20d318943453e396%40%3Ccommits.druid.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/re237267da268c690df5e1c6ea6a38a7fc11617725e8049490f58a6fa%40%3Ccommits.druid.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/rf70210b4d63191c0bfb2a0d5745e104484e71703bf5ad9cb01c980c6%40%3Ccommits.druid.apache.org%3E
Patch
https://www.oracle.com//security-alerts/cpujul2021.html
More from WebLogic Server
9.8
CVE-2022-22965
Spring Framework JDK 9+ Remote Code Execution Vulnerability
9.8
CVE-2020-14750
Oracle WebLogic Server Remote Code Execution Vulnerability
9.8
CVE-2020-14882
Oracle WebLogic Server Remote Code Execution Vulnerability
9.8
CVE-2020-14644
Oracle WebLogic Server Remote Code Execution Vulnerability
9.8
CVE-2020-2883
Oracle WebLogic Server Unspecified Vulnerability