CVE-2022-42743

2022-11-0300:00:00

Fluid Attacks

www.cve.org

deep-parse-json

external attacker

edit properties

add properties

json key validation

EPSS

0.001

Percentile

36.9%

JSON

deep-parse-json version 1.0.2 allows an external attacker to edit or add new properties to an object. This is possible because the application does not correctly validate the incoming JSON keys, thus allowing the ‘proto’ property to be edited.

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "deep-parse-json",
    "versions": [
      {
        "version": "1.0.2",
        "status": "affected"
      }
    ]
  }
]

References

fluidattacks.com/advisories/buuren/

github.com/sibu-github/deep-parse-json

EPSS

0.001

Percentile

36.9%

JSON

Related for CVELIST:CVE-2022-42743