VRT 391,192 CVEs tracked · 15,442 in RASP scope · data as of 19 hours ago

CVE-2023-5072

7.5 High Mitigation candidate

Description

Denial of Service in JSON-Java versions up to and including 20230618.  A bug in the parser means that an input string of modest size can lead to indefinite amounts of memory being used.

CWE-770CWE-358

Exploitation Status

No public exploit

Nothing published shows this CVE being exploited, which is not the same as ruling it out. nothing published in 2 years.

CVSS E:U

  • CISA KEV not listed
  • CISA Vulnrichment exploitation: none
  • Indexed PoC none indexed
  • EPSS 1.4% chance in 30 days

Waratek Defense Posture

Mitigation candidate

A defect of the type ARMR addresses, with a fix path to work from and a working exploit already published. This is a claim on attention, not a scheduling commitment: no rule exists and none is scheduled.

  • Protection none
  • Action unverified patch rule
  • Review human manual-review
  • Record active
Decided by manual classification : Manual classification of this CVE in the legacy dataset
Finding Manual classification assigned status: MITIGATION-CANDIDATE

CVSS

7.5 HIGH v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H 2 metrics

VRT selects the newest version's highest entry and publishes it as cvssScore, newest rather than largest because scores are not comparable across versions, and highest rather than first because the first entry is frequently a CNA placeholder scoring 0.0 over NVD's own analysis.

VersionScoreBandVectorAssignerType
CVSS 3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H cve-coordination@google.com Secondary published
CVSS 3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H NVD Primary

Affected Software & Releases

🏛️ Oracle CPU Advisories & Products

AdvisoryTypeQuarterProducts Oracle named in risk matrix
Oracle Critical Patch Update October 2024 ↗ CPU 2024-Q4 Oracle Systems / Tools (JSON-java) (4)
Oracle Critical Patch Update July 2024 ↗ CPU 2024-Q3 Oracle Fusion Middleware / Discussion Forums (JSON-java) (12.2.1.4.0)
Oracle Siebel CRM / EAI (JSON-java) (23.12 and prior)
Oracle Critical Patch Update April 2024 ↗ CPU 2024-Q2 Oracle Commerce / Platform (JSON-java) (11.3.0, 11.3.1, 11.3.2)
Oracle Communications / Security (JSON-java) (7.2.0.0.0-7.2.1.0.0)
Oracle Communications / User Interface (JSON-java) (9.1.1.7.0)
Oracle Construction and Engineering / Admin (JSON-java) (19.12.0-19.12.18, 20.12.0-20.12.13, 21.12.0-21.12.11)
Oracle Database Server / GraalVM Multilingual Engine (21.3-21.13)
Oracle Financial Services Applications / Accessibility (JSON-java) (14.5.0.0.0, 14.6.0.0.0, 14.7.0.0.0)
Oracle Financial Services Applications / Basic Config/Maintenances (JSON-java) (14.5.0.0.0, 14.6.0.0.0, 14.7.0.0.0)
Oracle Financial Services Applications / Collections (JSON-java) (2.7.0.0.0, 2.12.0.0.0)
Oracle Financial Services Applications / Common (JSON-java) (14.5.0.0.0, 14.6.0.0.0, 14.7.0.0.0)
Oracle Financial Services Applications / Common Core (JSON-java) (14.5.0.0.0, 14.6.0.0.0, 14.7.0.0.0)
Oracle Financial Services Applications / Security (JSON-java) (2.12.0.0.0)
Oracle Financial Services Applications / Web UI (JSON-java) (2.12.0.0.0)
Oracle Financial Services Applications / Web UI (JSON-java) (2.12.0.0.0)
Oracle Fusion Middleware / Centralized Thirdparty Jars (JSON-java) (14.1.1.0.0)
Oracle Fusion Middleware / Third Party (JSON-java) (12.2.1.3.0)
Oracle GoldenGate / Security (JSON-java) (19.1.0.0.0-19.1.0.0.8)
Oracle Health Sciences Applications / Core (JSON-java) (9.1.0.53, 9.2.0.53)
Oracle Critical Patch Update January 2024 ↗ CPU 2024-Q1 Oracle Analytics / Majel Mobile Service (JSON-java) (6.4.0.0.0, 7.0.0.0.0)
Oracle Commerce / Workbench (JSON-java) (11.3.2)
Oracle Communications / CMP (JSON-java) (12.6.1.0.0)
Oracle Communications / Platform (JSON-java) (23.3.1)
Oracle Communications / Signaling (JSON-java) (23.3.0)
Oracle Communications / Signaling (JSON-java) (23.3.1)
Oracle Communications Applications / Configuration (JSON-java) (3.0.3.3)
Oracle Communications Applications / REST Services Manager (JSON-java) (12.0.0.4.0-12.0.0.8.0, 15.0.0.0.0)
Oracle Construction and Engineering / Web (JSON-java) (19.12.0-19.12.22, 20.12.0-20.12.20, 21.12.0-21.12.17, 22.12.0-22.12.10)
Oracle Financial Services Applications / IDM - Authentication (JSON-java) (19.1.0, 21.1.0, 22.1.0, 22.2.0)
Oracle Financial Services Applications / UI General (JSON-java) (19.1.0, 21.1.0, 22.1.0, 22.2.0)
Oracle Fusion Middleware / BPM Composer (JSON-java) (12.2.1.4.0)
Oracle Fusion Middleware / Centralized Thirdparty Jars (JSON-java) (12.2.1.4.0)
Oracle Fusion Middleware / Content Server (JSON-java) (12.2.1.4.0)
Oracle Fusion Middleware / Third Party (JSON-java) (12.2.1.4.0)
Oracle GoldenGate / Oracle GoldenGate (JSON-java) (19.1.0.0.0-19.1.0.0.231017, 21.3-21.12)
Oracle Hyperion / Installation and Configuration (JSON-java) (11.2.14.0.000)
Oracle Hyperion / Security (JSON-java) (11.2.14.0.000)
Oracle Hyperion / Security (JSON-java) (11.2.14.0.000)
Oracle Hyperion / Security (JSON-java) (11.2.14.0.000)
Oracle Java SE / Tools (JSON-java) (Oracle GraalVM for JDK: 17.0.9, 21.0.1; Oracle GraalVM Enterprise Edition: 20.3.12, 21.3.8, 22.3.4)
Oracle PeopleSoft / Open Search, Elastic Search, Web Server (JSON-java) (8.59, 8.60, 8.61)

Indexed Oracle Components & Versions

FamilyComponentOracle's version cell (verbatim)Indexed as
Oracle Analytics Majel Mobile Service (JSON-java) 6.4.0.0.0, 7.0.0.0.0 6.4.0.0.0 · 7.0.0.0.0
Oracle Commerce Platform (JSON-java) 11.3.0, 11.3.1, 11.3.2 11.3.0 · 11.3.1 · 11.3.2
Oracle Commerce Workbench (JSON-java) 11.3.2 11.3.2
Oracle Communications CMP (JSON-java) 12.6.1.0.0 12.6.1.0.0
Oracle Communications Platform (JSON-java) 23.3.1 23.3.1
Oracle Communications Security (JSON-java) 7.2.0.0.0-7.2.1.0.0
Oracle Communications Signaling (JSON-java) 23.3.0 23.3.0 · 23.3.1
Oracle Communications User Interface (JSON-java) 9.1.1.7.0 9.1.1.7.0
Oracle Communications Applications Configuration (JSON-java) 3.0.3.3 3.0.3.3
Oracle Communications Applications REST Services Manager (JSON-java) 12.0.0.4.0-12.0.0.8.0, 15.0.0.0.0 15.0.0.0.0
Oracle Construction and Engineering Admin (JSON-java) 19.12.0-19.12.18, 20.12.0-20.12.13, 21.12.0-21.12.11
Oracle Construction and Engineering Web (JSON-java) 19.12.0-19.12.22, 20.12.0-20.12.20, 21.12.0-21.12.17, 22.12.0-22.12.10
Oracle Database Server GraalVM Multilingual Engine 21.3-21.13
Oracle Financial Services Applications Accessibility (JSON-java) 14.5.0.0.0, 14.6.0.0.0, 14.7.0.0.0 14.5.0.0.0 · 14.6.0.0.0 · 14.7.0.0.0
Oracle Financial Services Applications Basic Config/Maintenances (JSON-java) 14.5.0.0.0, 14.6.0.0.0, 14.7.0.0.0 14.5.0.0.0 · 14.6.0.0.0 · 14.7.0.0.0
Oracle Financial Services Applications Collections (JSON-java) 2.7.0.0.0, 2.12.0.0.0 2.7.0.0.0 · 2.12.0.0.0
Oracle Financial Services Applications Common (JSON-java) 14.5.0.0.0, 14.6.0.0.0, 14.7.0.0.0 14.5.0.0.0 · 14.6.0.0.0 · 14.7.0.0.0
Oracle Financial Services Applications Common Core (JSON-java) 14.5.0.0.0, 14.6.0.0.0, 14.7.0.0.0 14.5.0.0.0 · 14.6.0.0.0 · 14.7.0.0.0
Oracle Financial Services Applications IDM - Authentication (JSON-java) 19.1.0, 21.1.0, 22.1.0, 22.2.0 19.1.0 · 21.1.0 · 22.1.0 · 22.2.0
Oracle Financial Services Applications Security (JSON-java) 2.12.0.0.0 2.12.0.0.0
Oracle Financial Services Applications UI General (JSON-java) 19.1.0, 21.1.0, 22.1.0, 22.2.0 19.1.0 · 21.1.0 · 22.1.0 · 22.2.0
Oracle Financial Services Applications Web UI (JSON-java) 2.12.0.0.0 2.12.0.0.0
Oracle Fusion Middleware BPM Composer (JSON-java) 12.2.1.4.0 12.2.1.4.0
Oracle Fusion Middleware Centralized Thirdparty Jars (JSON-java) 12.2.1.4.0 12.2.1.4.0 · 14.1.1.0.0
Oracle Fusion Middleware Content Server (JSON-java) 12.2.1.4.0 12.2.1.4.0
Oracle Fusion Middleware Discussion Forums (JSON-java) 12.2.1.4.0 12.2.1.4.0
Oracle Fusion Middleware Third Party (JSON-java) 12.2.1.3.0 12.2.1.3.0 · 12.2.1.4.0
Oracle GoldenGate Oracle GoldenGate (JSON-java) 19.1.0.0.0-19.1.0.0.231017, 21.3-21.12
Oracle GoldenGate Security (JSON-java) 19.1.0.0.0-19.1.0.0.8
Oracle Health Sciences Applications Core (JSON-java) 9.1.0.53, 9.2.0.53 9.1.0.53 · 9.2.0.53
Oracle Hyperion Installation and Configuration (JSON-java) 11.2.14.0.000 11.2.14.0.0
Oracle Hyperion Security (JSON-java) 11.2.14.0.000 11.2.14.0.0
Oracle Java SE Tools (JSON-java) Oracle GraalVM for JDK: 17.0.9, 21.0.1; Oracle GraalVM Enterprise Edition: 20.3.12, 21.3.8, 22.3.4 17.0.9.0 · 20.3.12.0 · 21.0.1.0 · 21.3.8.0 · 22.3.4.0
Oracle PeopleSoft Open Search, Elastic Search, Web Server (JSON-java) 8.59, 8.60, 8.61 8.59 · 8.60 · 8.61
Oracle Siebel CRM EAI (JSON-java) 23.12 and prior
Oracle Systems Tools (JSON-java) 4 4

☕ Maven Library Packages

Artifact coordinates and fix boundaries from OSV.dev
Package CoordinateIntroducedFixedLast affected
org.json:json 0 20231013 unbounded

🖥️ Product CPEs & Version Ranges

2 product(s) over 2 version claims (uncapped)
SourceVendorProductSchemeAffected Versions
osv org.json json generic ＜ 99999
nvd stleary json-java generic ≤ 99999

References

URLTags
https://github.com/google/security-research/security/advisories/GHSA-4jq9-2xhw-jpx7 WEB
https://github.com/stleary/JSON-java/issues/758 WEB
https://github.com/stleary/JSON-java/issues/771 WEB
https://github.com/stleary/JSON-java/pull/759 WEB
https://github.com/stleary/JSON-java/commit/60662e2f8384d3449822a3a1179bfe8de67b55bb WEB
https://github.com/stleary/JSON-java PACKAGE
http://www.openwall.com/lists/oss-security/2023/12/13/4
https://security.netapp.com/advisory/ntap-20240621-0007/

Timeline

Published 2023-10-12 Last modified 2026-06-17
Published2023-10-12By the CVE Program.
NVD record modified2026-06-17NVD's own last-modified date for this record.