CVE-2022-47937 Multiple parsing problems in the Apache Sling Commons JSON module

2023-05-1509:20:23

CWE-20

apache

www.cve.org

cve-2022-47937

apache sling

json module

input validation

apache johnzon

deprecated bundle

AI Score

9.7

Confidence

High

EPSS

0.005

Percentile

75.9%

JSON

Improper input validation in the Apache Sling Commons JSON bundle allows an attacker to trigger unexpected errors by supplying specially-crafted input.

The org.apache.sling.commons.json bundle has been deprecated as of March
2017 and should not be used anymore. Consumers are encouraged to
consider the Apache Sling Commons Johnzon OSGi bundle provided by the
Apache Sling project, but may of course use other JSON libraries.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "org.apache.sling.commons.json",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThanOrEqual": "2.0.20",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]