CVE-2021-27568
| Affected software | 7 products, listed below |
|---|---|
| Severity | 5.9 Medium CVSS 3.1 2 scores |
| Fixed in | 1.3.2, 2.4.1, 2.3.1 |
| Weakness | CWE-754 |
| Published | 23 Feb 2021 |
| Updated | 8 Oct 2026 |
Description
An issue was discovered in netplex json-smart-v1 through 2015-10-23 and json-smart-v2 through 2.4. An exception is thrown from a function, but it is not caught, as demonstrated by NumberFormatException. When it is not caught, it may cause programs using the library to crash or expose sensitive information.
Exploitation status
No public exploit
No exploit has been reported in the sources we check. The 1 repository below are public GitHub repositories with fewer than 5 stars.
Exploitation status
- CISA KEV not listed
- VulnCheck KEV not listed
- CISA Vulnrichment exploitation: none
- Indexed PoC 1 indexed, none at 5+ stars
- EPSS 2.9% chance in 30 days
| Index | Artifact | Stars | First seen |
|---|---|---|---|
| GitHub PoC | Demo of CVE-2021-27568: Insecure randomness in token generation | 2025-07-07 |
Waratek protection
Waratek has a rule that blocks attacks on this vulnerability.
- Protection full
- Action available patch rule
- Review human ARMR file
- Record active
| Decided by | An ARMR patch file on disk for this CVE |
|---|---|
| Finding | CVE has an ARMR patch rule that provides mitigation |
ARMR rule files
2 filesThe rule files Waratek ships for this CVE. Some CVEs need more than one, for example one per affected library or one per ARMR version.
CVE-2021-27568.armr patch rule, ARMR 2.6 added 2022-06-08 updated 2022-06-20CVE-2021-27568-2.armr patch rule, ARMR 2.6 added 2022-06-08 updated 2025-05-08How to mitigate CVE-2021-27568
Upgrade the affected software to a release that fixes it: 1.3.2, 2.4.1 or 2.3.1. Until you can, Waratek RASP blocks exploitation with a rule written for this CVE. It runs inside the Java application, with no code changes.
Waratek RASP Runtime protection for Java applications
CVSS
5.9 MEDIUM
v3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
2 metrics
CVSS
5.9 MEDIUM v3.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
2 metrics
We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.
| Version | Score | Band | Vector | Assigner | Type | |
|---|---|---|---|---|---|---|
| CVSS 3.1 | 5.9 | MEDIUM | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H |
NVD | Primary | published |
| CVSS 2.0 | 4.3 | none | AV:N/AC:M/Au:N/C:N/I:N/A:P |
NVD | Primary |
Affected software and releases
Oracle advisories
| Advisory | Type | Quarter | Products Oracle names in its risk matrix |
|---|---|---|---|
| Oracle Critical Patch Update July 2024 ↗ | CPU | 2024-Q3 | Oracle Analytics / Analytics Server (json-smart) (7.0.0.0.0, 12.2.1.4.0) |
| Oracle Critical Patch Update April 2023 ↗ | CPU | 2023-Q2 | Oracle Analytics / BI Application Archive (json-smart) (6.4.0.0.0) |
| Oracle Critical Patch Update January 2022 ↗ | CPU | 2022-Q1 | Oracle Communications / Policy (netplex json-smart) (1.14.0) Oracle Fusion Middleware / Web Services (json-smart) (12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0) Oracle Support Tools / Diagnostic Assistant (json-smart) (Prior to 2.12.42) Oracle Utilities Applications / Common (json-smart) (4.4.0.0.0, 4.4.0.2.0, 4.4.0.3.0) |
| Oracle Critical Patch Update July 2021 ↗ | CPU | 2021-Q3 | Oracle PeopleSoft / REST Services (netplex json-smart-v1) (8.58, 8.59) |
Oracle components and versions
| Family | Component | Versions, as Oracle lists them | Read as |
|---|---|---|---|
| Oracle Analytics | Analytics Server (json-smart) | 7.0.0.0.0, 12.2.1.4.0 | 7.0.0.0.0 · 12.2.1.4.0 |
| Oracle Analytics | BI Application Archive (json-smart) | 6.4.0.0.0 | 6.4.0.0.0 |
| Oracle Communications | Policy (netplex json-smart) | 1.14.0 | 1.14.0 |
| Oracle Fusion Middleware | Web Services (json-smart) | 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0 | 12.2.1.3.0 · 12.2.1.4.0 · 14.1.1.0.0 |
| Oracle PeopleSoft | REST Services (netplex json-smart-v1) | 8.58, 8.59 | 8.58 · 8.59 |
| Oracle Support Tools | Diagnostic Assistant (json-smart) | Prior to 2.12.42 | |
| Oracle Utilities Applications | Common (json-smart) | 4.4.0.0.0, 4.4.0.2.0, 4.4.0.3.0 | 4.4.0.0.0 · 4.4.0.2.0 · 4.4.0.3.0 |
Maven packages
Affected and fixed versions, from OSV.dev| Package | Introduced | Fixed | Last affected |
|---|---|---|---|
net.minidev:json-smart |
0 | 1.3.2 |
unbounded |
net.minidev:json-smart |
2.4.0 | 2.4.1 |
unbounded |
net.minidev:json-smart-mini |
0 | 1.3.2 |
unbounded |
net.minidev:json-smart |
2.0.0 | 2.3.1 |
unbounded |
Products and versions
9 products, 17 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| nvd | json-smart project | json-smart-v1 | generic | ＜ 1.3.2 |
| nvd | json-smart project | json-smart-v2 | generic | ＜ 2.3.1 · ≥ 2.4 and ＜ 2.4.1 |
| osv | net.minidev | json-smart | generic | ＜ 1.3.2 · ≥ 2.0.0 and ＜ 2.3.1 · ≥ 2.4.0 and ＜ 2.4.1 |
| osv | net.minidev | json-smart-mini | generic | ＜ 1.3.2 |
| nvd | oracle | communications cloud native core policy | generic | 1.14.0 |
| nvd | oracle | oss support tools | generic | ＜ 2.12.42 |
| nvd | oracle | peoplesoft enterprise peopletools | generic | 8.58 · 8.59 |
| nvd | oracle | utilities framework | generic | 4.4.0.0.0 · 4.4.0.2.0 · 4.4.0.3.0 |
| nvd | oracle | weblogic server | generic | 12.2.1.3.0 · 12.2.1.4.0 · 14.1.1.0.0 |
References
Timeline
Timeline
| Published | 2021-02-23 | By the CVE Program. |
|---|---|---|
| ARMR remediation created | 2022-06-08 | Earliest commit adding this CVE's ARMR patch or security rule. |
| ARMR remediation last updated | 2025-05-08 | Most recent commit touching this CVE's ARMR patch or security rule. |
| Last VRT activity | 2025-05-08 | Most recent commit touching this CVE's classification, patch or rule file. |
| NVD record modified | 2026-10-08 | NVD's own last-modified date for this record. |