CVE-2021-31875

Katalog CVE

CVSS 9.8 · Critical EPSS 2,2%

Kerentanan Off-by-one Error pada cesanta mongooseos mjs. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

In mjs_json.c in Cesanta MongooseOS mJS 1.26, a maliciously formed JSON string can trigger an off-by-one heap-based buffer overflow in mjs_json_parse, which can potentially lead to redirection of control flow. NOTE: the original reporter disputes the significance of this finding because "there isn’t very much of an opportunity to exploit this reliably for an information leak, so there isn’t any real security impact."

Rincian

Terbit di NVD

29 April 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-193: Off-by-one Error
CWE-787: Out-of-bounds Write

EPSS (30 hari)

2,2% peluang dieksploitasi; lebih tinggi dari 81,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/418sec/mjs/pull/2 patch · advisory pihak ketiga
• https://github.com/cesanta/mjs/releases/tag/1.26 release notes · advisory pihak ketiga
• https://huntr.dev/bounties/1-other-mjs/ exploit · advisory pihak ketiga