The vulnerability of the JSON Schema application for checking and testing JSON files lies in the lack of adequate control over the modification of dynamically defined object properties, allowing a perpetrator to execute arbitrary code.

🗓️ 29 Jul 2022 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

JSON Schema testing app vulnerable to code execution from poorly controlled dynamic properties.

Reporter	Title	Published	Views	Family All 197
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in CloudPak for Watson AIOPs	25 Oct 202214:32	–	ibm
IBM Security Bulletins	Security Bulletin: Critical Vulnerabilities in libraries used by libraries that IBM Spectrum discover is using (libraries of libraries)	28 Mar 202216:33	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in Node.js affect IBM Cloud Pak System	17 Aug 202209:46	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities found on thirdparty libraries used by IBM® MobileFirst Platform	26 Jan 202317:01	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities affecting IBM Watson Studio in Cloud Pak for Data are addressed	23 Jun 202516:45	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar User Behavior Analytics is vulnerable to components with known vulnerabilities	30 Mar 202316:06	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Security includes components with multiple known vulnerabilities	12 Jan 202317:19	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Machine Learning Accelerator on Cloud Pak for Data is vulnerable to multiple vulnerabilities	12 Dec 202317:28	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar Use Case Manager app is vulnerable to using components with known vulnerabilities	20 Apr 202214:01	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in json4j - CVE-2021-3918 (Publicly disclosed vulnerability) impacts IBM Watson Machine Learning Accelerator	7 Apr 202203:42	–	ibm

Vulners

Node

novell suse_linux_enterprise_high_performance_computingMatch12

novell suse_linux_enterprise_module_for_web_scriptingMatch12

novell suse_enterprise_storageMatch6

novell suse_linux_enterprise_high_performance_computingMatch15-espos

novell suse_linux_enterprise_high_performance_computingMatch15-ltss

red_hat red_hat_quayMatch3

novell suse_caas_platformMatch4.0

red_hat openshift_service_meshMatch2

novell suse_manager_proxyMatch4.2

novell suse_manager_serverMatch4.2

novell suse_enterprise_storageMatch7

novell suse_manager_serverMatch4.1

novell suse_manager_proxyMatch4.1

novell suse_manager_retail_branch_serverMatch4.1

red_hat red_hat_advanced_cluster_management_for_kubernetesMatch2

red_hat red_hat_openshift_container_platformMatch4

novell suse_manager_retail_branch_serverMatch4.2

red_hat red_hat_advanced_cluster_management_for_kubernetesMatch2.3

red_hat red_hat_advanced_cluster_management_for_kubernetesMatch2.4

red_hat openshift_service_meshMatch2.1.0

novell suse_enterprise_storageMatch7.1

red_hat red_hat_advanced_cluster_management_for_kubernetesMatch2.5

node.js node.jsRange<16.11.0

red_hat red_hat_enterprise_linuxMatch8

novell suse_linux_enterprise_server_for_sap_applicationsMatch15

novell suse_linux_enterprise_serverMatch15-ltss

novell suse_linux_enterprise_server_for_sap_applicationsMatch12

novell opensuse_leapMatch15.3

novell suse_linux_enterprise_serverMatch12

novell opensuse_leapMatch15.4

red_hat red_hat_enterprise_linuxMatch9

Source	Link
access	www.access.redhat.com/security/cve/CVE-2021-3918
json-schema	www.json-schema.org/
suse	www.suse.com/security/cve/CVE-2021-3918.html
github	www.github.com/kriszyp/json-schema/commit/22f146111f541d9737e832823699ad3528ca7741
huntr	www.huntr.dev/bounties/bb6ccd63-f505-4e3a-b55f-cd2662c261a9
nvd	www.nvd.nist.gov/vuln/detail/CVE-2021-3918
xn--80ahaefyxhn	www.xn--80ahaefyxhn.xn--j1afgaq.xn--p1ai/bin/view/%D0%9E%D0%A1%D0%BD%D0%BE%D0%B2%D0%B0/%D0%9E%D0%B1%D0%BD%D0%BE%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D1%8F/2.6/
repo	www.repo.red-soft.ru/redos/7.3c/x86_64/updates/
web	www.web.nvd.nist.gov/view/vuln/detail

13 Sep 2024 00:00Current

7.2High risk

Vulners AI Score7.2

CVSS 39.8

CVSS 210

EPSS0.03563