CVE-2024-21907

Katalog CVE

CVSS 7.5 · High EPSS 32,9%

Kerentanan Improper Handling of Exceptional Conditions pada newtonsoft json.net. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Newtonsoft.Json before version 13.0.1 is affected by a mishandling of exceptional conditions vulnerability. Crafted data that is passed to the JsonConvert.DeserializeObject method may trigger a StackOverflow exception resulting in denial of service. Depending on the usage of the library, an unauthenticated and remote attacker may be able to cause the denial of service condition.

Rincian

Terbit di NVD

3 Januari 2024

Terakhir diubah

14 Juli 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-755: Improper Handling of Exceptional Conditions

EPSS (30 hari)

32,9% peluang dieksploitasi; lebih tinggi dari 98,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/JamesNK/Newtonsoft.Json/commit/7e77bbe1beccceac4fc7b174b53abfefac278b66 patch
• https://github.com/JamesNK/Newtonsoft.Json/pull/2462 patch
• https://github.com/JamesNK/Newtonsoft.Json/issues/2457 exploit · issue tracking · advisory pihak ketiga
• https://github.com/advisories/GHSA-5crp-9r3c-p9vr advisory pihak ketiga
• https://security.snyk.io/vuln/SNYK-DOTNET-NEWTONSOFTJSON-2774678 exploit · advisory pihak ketiga
• https://vulncheck.com/advisories/vc-advisory-GHSA-5crp-9r3c-p9vr advisory pihak ketiga
• https://alephsecurity.com/2018/10/22/StackOverflowException/ exploit
• https://alephsecurity.com/vulns/aleph-2018004 exploit