Paper/Archive/CVE-2022-47937

CVE-2022-47937

Apache Software Foundation org.apache.sling.commons.json — Multiple parsing problems in the Apache Sling Commons JSON module

EPSS 2%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD, ADP agree)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 82.4.824 × 2016.5 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Improper input validation in the Apache Sling Commons JSON bundle allows an attacker to trigger unexpected errors by supplying specially-crafted input. The org.apache.sling.commons.json bundle has been deprecated as of March 2017 and should not be used anymore. Consumers are encouraged to consider the Apache Sling Commons Johnzon OSGi bundle provided by the Apache Sling project, but may of course use other JSON libraries.

Affected

ProductAffectedFixed inSource

org.apache.sling.commons.json≤ 2.0.20–CNA

sling_commons_json≤ 2.0.20–CISA-ADP

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refissues.apache.org/jira/browse/SLING-6536 refgithub.com/apache/sling-org-apache-sling-commons-johnzon advisorylists.apache.org/thread/sws7z50x47gv0c38q4kx6ktqrvrrg1pm refopenwall.com/lists/oss-security/2023/05/15/2