CVE-2023-0842

2023-04-0500:00:00

Fluid Attacks

www.cve.org

cve-2023-0842

json keys

object property manipulation

external attacker

application vulnerability

5.4 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

39.6%

JSON

xml2js version 0.4.23 allows an external attacker to edit or add new properties to an object. This is possible because the application does not properly validate incoming JSON keys, thus allowing the proto property to be edited.

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "xml2js",
    "versions": [
      {
        "version": "0.4.23",
        "status": "affected"
      }
    ]
  }
]