Vulnerability · Published May 15, 2023 · Assigned by apache

CVE-2022-47937Multiple parsing problems in the Apache Sling Commons JSON module

Critical 9.8

In plain English

A critical-severity improper input validation in org.apache.sling.commons.json from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.2% (higher than 82% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)2.2%top 17.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Improper input validation in the Apache Sling Commons JSON bundle allows an attacker to trigger unexpected errors by supplying specially-crafted input. The org.apache.sling.commons.json bundle has been deprecated as of March 2017 and should not be used anymore. Consumers are encouraged to consider the Apache Sling Commons Johnzon OSGi bundle provided by the Apache Sling project, but may of course use other JSON libraries.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	org.apache.sling:org.apache.sling.commons.json	no fix listed	GHSA-8j28-34qq-gmch

Affected products (as reported)

Vendor	Product	Versions
Apache Software Foundation	org.apache.sling.commons.json	0 – through 2.0.20

Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://issues.apache.org/jira/browse/SLING-6536 issue-tracking
https://github.com/apache/sling-org-apache-sling-commons-johnzon related
https://lists.apache.org/thread/sws7z50x47gv0c38q4kx6ktqrvrrg1pm vendor-advisory
https://www.openwall.com/lists/oss-security/2023/05/15/2