What is the CVSS score of CVE-2023-1370?

CVE-2023-1370 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 1.1%.

Which versions of Json Smart are affected by CVE-2023-1370?

[Json-smart](https://netplex.github.io/json-smart/) is a performance focused, JSON processor lib.. A patch is available.

Is there a public PoC exploit available for CVE-2023-1370?

Yes, a public proof-of-concept exploit is available for CVE-2023-1370. Prioritise patching immediately. EPSS: 1.1%.

Is there a patch available for CVE-2023-1370?

Yes, a patch is available for CVE-2023-1370. Update the affected software to the latest version immediately.

Json Smart CVE-2023-1370

HIGH

Uncontrolled Recursion (CWE-674)

2023-03-22 reefs@jfrog.com

Denial Of Service Json Smart

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

CVE Published

Mar 22, 2023 - 06:15 nvd

HIGH 7.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

732 maven packages depend on net.minidev:json-smart (67 direct, 665 indirect)

Ecosystem-wide dependent count for version 2.4.9.

DescriptionNVD

Json-smart is a performance focused, JSON processor lib.

When reaching a ‘[‘ or ‘{‘ character in the JSON input, the code parses an array or an object respectively.

It was discovered that the code does not have any limit to the nesting of such arrays or objects. Since the parsing of nested arrays and objects is done recursively, nesting too many of them can cause a stack exhaustion (stack overflow) and crash the software.

AnalysisAI

Json-smart is a performance focused, JSON processor lib. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-674. Json-smart is a performance focused, JSON processor lib. When reaching a ‘[‘ or ‘{‘ character in the JSON input, the code parses an array or an object respectively. It was discovered that the code does not have any limit to the nesting of such arrays or objects. Since the parsing of nested arrays and objects is done recursively, nesting too many of them can cause a stack exhaustion (stack overflow) and crash the software. Affected products include: Json-Smart Project Json-Smart.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.