Description

jpv (aka Json Pattern Validator) before 2.2.2 does not properly validate input, as demonstrated by a corrupted array.

Remediation

References

https://blog.sonatype.com/cve-2020-17479

https://github.com/manvel-khnkoyan/jpv/commit/e3eec1215caa8d5c560f5e88d0943422831927d6

https://github.com/manvel-khnkoyan/jpv/issues/10

https://www.npmjs.com/package/jpv

Related Vulnerabilities

CVE-2023-27162 Vulnerability in maven package org.openapitools:openapi-generator-project

CVE-2023-25826 Vulnerability in maven package net.opentsdb:opentsdb

CVE-2021-23379 Vulnerability in npm package portkiller

CVE-2022-31690 Vulnerability in maven package org.springframework.security:spring-security-oauth2-client

CVE-2023-26477 Vulnerability in maven package org.xwiki.platform:xwiki-platform-flamingo-theme-ui

Severity

Critical

Classification

CWE-20 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Exploit Third Party Advisory Patch Product