7.5
CVE-2020-10663
- EPSS 6.54%
- Veröffentlicht 28.04.2020 21:15:11
- Zuletzt bearbeitet 21.11.2024 04:55:47
- Quelle cve@mitre.org
- CVE-Watchlists
- Unerledigt
LoginThe JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsing methods can lead to creation of a malicious object within the interpreter, with adverse effects that are application-dependent.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Json Project ≫ Json SwPlatformruby Version <= 2.2.0
Fedoraproject ≫ Fedora Version30
Fedoraproject ≫ Fedora Version31
Debian ≫ Debian Linux Version8.0
Debian ≫ Debian Linux Version10.0
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 6.54% | 0.908 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 7.5 | 3.9 | 3.6 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
|
| nvd@nist.gov | 5 | 10 | 2.9 |
AV:N/AC:L/Au:N/C:N/I:P/A:N
|
CWE-20 Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.