[Json-smart](https://netplex.github.io/json-smart/) is a performance focused, JSON processor lib. When reaching a ‘[‘ or ‘{‘ character in the JSON input, the code parses an array or an object respectively. It was discovered that the code does not have any limit to the nesting of such arrays or objects. Since the parsing of nested arrays and objects is done recursively, nesting too many of them can cause a stack exhaustion (stack overflow) and crash the software.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:3610 advisory.

  - jackson-databind: Possible DoS if using JDK serialization to serialize JsonNode (CVE-2021-46877)

  - maven-shared-utils: Command injection via Commandline class (CVE-2022-29599)

  - Jenkins plugin: CSRF vulnerability in Blue Ocean Plugin (CVE-2022-30953)

  - Jenkins plugin: missing permission checks in Blue Ocean Plugin (CVE-2022-30954)

  - jettison: parser crash by stackoverflow (CVE-2022-40149)

  - jettison: memory exhaustion via user-supplied XML or JSON data (CVE-2022-40150)

  - jettison:  If the value in map is the map's self, the new new JSONObject(map) cause StackOverflowError     which may lead to dos (CVE-2022-45693)

  - json-smart: Uncontrolled Resource Consumption vulnerability in json-smart (Resource Exhaustion)     (CVE-2023-1370)

  - springframework: Security Bypass With Un-Prefixed Double Wildcard Pattern (CVE-2023-20860)

  - springframework: Spring Expression DoS Vulnerability (CVE-2023-20861)

  - jenkins-2-plugins/script-security: Sandbox bypass vulnerability in Script Security Plugin (CVE-2023-24422)

  - jenkins-2-plugin: workflow-job: Stored XSS vulnerability in Pipeline: Job Plugin (CVE-2023-32977)

  - jenkins-2-plugin: pipeline-utility-steps: Arbitrary file write vulnerability on agents in Pipeline Utility     Steps Plugin (CVE-2023-32981)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:3622 advisory.

  - maven-shared-utils: Command injection via Commandline class (CVE-2022-29599)

  - Jenkins plugin: CSRF vulnerability in Blue Ocean Plugin (CVE-2022-30953)

  - Jenkins plugin: missing permission checks in Blue Ocean Plugin (CVE-2022-30954)

  - json-smart: Uncontrolled Resource Consumption vulnerability in json-smart (Resource Exhaustion)     (CVE-2023-1370)

  - jettison: Uncontrolled Recursion in JSONArray (CVE-2023-1436)

  - springframework: Security Bypass With Un-Prefixed Double Wildcard Pattern (CVE-2023-20860)

  - springframework: Spring Expression DoS Vulnerability (CVE-2023-20861)

  - Jenkins: Temporary file parameter created with insecure permissions (CVE-2023-27903)

  - Jenkins: Information disclosure through error stack traces related to agents (CVE-2023-27904)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:3663 advisory.

  - http2-server: Invalid HTTP/2 requests cause DoS (CVE-2022-2048)

  - springframework: BCrypt skips salt rounds for work factor of 31 (CVE-2022-22976)

  - jettison: parser crash by stackoverflow (CVE-2022-40149)

  - jettison: memory exhaustion via user-supplied XML or JSON data (CVE-2022-40150)

  - xstream: Denial of Service by injecting recursive collections or maps based on element's hash values     raising a stack overflow (CVE-2022-41966)

  - jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS (CVE-2022-42003)

  - jackson-databind: use of deeply nested arrays (CVE-2022-42004)

  - json-smart: Uncontrolled Resource Consumption vulnerability in json-smart (Resource Exhaustion)     (CVE-2023-1370)

  - jettison: Uncontrolled Recursion in JSONArray (CVE-2023-1436)

  - springframework: Security Bypass With Un-Prefixed Double Wildcard Pattern (CVE-2023-20860)

  - log4j1-chainsaw, log4j1-socketappender: DoS via hashmap logging (CVE-2023-26464)

  - Jenkins: XSS vulnerability in plugin manager (CVE-2023-27898)

  - Jenkins: Temporary plugin file created with insecure permissions (CVE-2023-27899)

  - Jenkins: Temporary file parameter created with insecure permissions (CVE-2023-27903)

  - Jenkins: Information disclosure through error stack traces related to agents (CVE-2023-27904)

  - jenkins-2-plugin: workflow-job: Stored XSS vulnerability in Pipeline: Job Plugin (CVE-2023-32977)

  - jenkins-2-plugin: pipeline-utility-steps: Arbitrary file write vulnerability on agents in Pipeline Utility     Steps Plugin (CVE-2023-32981)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:3362 advisory.

  - json-smart: Uncontrolled Resource Consumption vulnerability in json-smart (Resource Exhaustion)     (CVE-2023-1370)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of IBM Cognos Analytics installed on the remote host is prior to 11.1.7 FP8, 11.2.4 FP3, or 12.0.2. It is, therefore, affected by multiple vulnerabilities as referenced in the IBM Security Bulletin No. 7123154, including the following:

  - When deserializing untrusted or corrupted data, it is possible for a reader to consume memory beyond the   allowed constraints and thus lead to out of memory on the system. This issue affects Java applications using   Apache Avro Java SDK up to and including 1.11.2. Users should update to apache-avro version 1.11.3 which   addresses this issue. (CVE-2023-39410)

  - In order to decrypt SM2 encrypted data an application is expected to call the API function   EVP_PKEY_decrypt(). Typically an application will call this function twice. The first time, on entry, the   'out' parameter can be NULL and, on exit, the 'outlen' parameter is populated with the buffer size required   to hold the decrypted plaintext. The application can then allocate a sufficiently sized buffer and call   EVP_PKEY_decrypt() again, but this time passing a non-NULL value for the 'out' parameter. A bug in the   implementation of the SM2 decryption code means that the calculation of the buffer size required to hold the   plaintext returned by the first call to EVP_PKEY_decrypt() can be smaller than the actual size required by   the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is called by the application a   second time with a buffer that is too small. A malicious attacker who is able present SM2 content for   decryption to an application could cause attacker chosen data to overflow the buffer by up to a maximum of   62 bytes altering the contents of other data held after the buffer, possibly changing application behaviour   or causing the application to crash. The location of the buffer is application dependent but is typically   heap allocated. Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k). (CVE-2021-3711)

  - SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization.
  Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using   SnakeYaml's SafeConsturctor when parsing untrusted content to restrict deserialization. We recommend   upgrading to version 2.0 and beyond. (CVE-2022-1471)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The versions of Oracle Application Testing Suite installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2024 CPU advisory:

  - Vulnerability in the Oracle Application Testing Suite product of Oracle Enterprise Manager (component: Load     Testing for Web Apps (BSAFE Crypto-J)). The supported version that is affected is 13.3.0.1. Easily exploitable     vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application     Testing Suite. Successful attacks of this vulnerability can result in takeover of Oracle Application Testing     Suite. (CVE-2022-34381)

  - Vulnerability in the Oracle Application Testing Suite product of Oracle Enterprise Manager (component: Load Testing     for Web Apps (Apache Commons BCEL)). The supported version that is affected is 13.3.0.1. Easily exploitable     vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Testing     Suite. Successful attacks of this vulnerability can result in takeover of Oracle Application Testing Suite.
    (CVE-2022-42920)

  - Vulnerability in the Oracle Application Testing Suite product of Oracle Enterprise Manager (component: Load Testing     for Web Apps (Apache Derby)). The supported version that is affected is 13.3.0.1. Easily exploitable vulnerability     allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Testing Suite.     Successful attacks of this vulnerability can result in takeover of Oracle Application Testing Suite.
    (CVE-2022-46337)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of IBM Engineering Requirements Management DOORS (formerly IBM Rational DOORS) installed on the remote host is 9.7.2.x prior to 9.7.2.8. It is, therefore, affected by multiple vulnerabilities as referenced in the 7124058 advisory.

  - Apache Shiro before 1.9.1, A RegexRequestMatcher can be misconfigured to be bypassed on some servlet     containers. Applications using RegExPatternMatcher with `.` in the regular expression are possibly     vulnerable to an authorization bypass. (CVE-2022-32532)

  - The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow     a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary     shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client     or the broker (respectively) to instantiate any class on the classpath. Users are recommended to upgrade     both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 which fixes this issue.
    (CVE-2023-46604)

  - Scala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR file. On its own, it cannot be     exploited. There is only a risk in conjunction with Java object deserialization within an application. In     such situations, it allows attackers to erase contents of arbitrary files, make network connections, or     possibly run arbitrary code (specifically, Function0 functions) via a gadget chain. (CVE-2022-36944)

  - IBM Engineering Requirements Management DOORS 9.7.2.7 is vulnerable to cross-site request forgery which     could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the     website trusts. IBM X-Force ID: 251216. (CVE-2023-28949)

  - A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows     remote attackers to inject arbitrary web script through a crafted protected comment (with the     cke_protected syntax). (CVE-2020-9281)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:3362 advisory.

  - [Json-smart](https://netplex.github.io/json-smart/) is a performance focused, JSON processor lib. When     reaching a [ or { character in the JSON input, the code parses an array or an object respectively. It     was discovered that the code does not have any limit to the nesting of such arrays or objects. Since the     parsing of nested arrays and objects is done recursively, nesting too many of them can cause a stack     exhaustion (stack overflow) and crash the software. (CVE-2023-1370)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Atlassian Jira Service Management Data Center and Server (Jira Service Desk) running on the remote host is affected by a vulnerability as referenced in the JSDSERVER-14746 advisory.

  - [Json-smart](https://netplex.github.io/json-smart/) is a performance focused, JSON processor lib. When     reaching a [ or { character in the JSON input, the code parses an array or an object respectively. It     was discovered that the code does not have any limit to the nesting of such arrays or objects. Since the     parsing of nested arrays and objects is done recursively, nesting too many of them can cause a stack     exhaustion (stack overflow) and crash the software. (CVE-2023-1370)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of IBM Cognos Analytics installed on the remote host is 11.1.x prior to 11.1.7 Fix Pack 7 or 11.2.x prior to 11.2.4 FP2. It is, therefore, affected by multiple vulnerabilities, including the following:

  - netplex json-smart-v2 is vulnerable to a denial of service, caused by not limiting the nesting of arrays   or objects. By sending a specially crafted input, a remote attacker could exploit this vulnerability to   cause a stack exhaustion and crash the software. (CVE-2023-1370)

  - Express.js Express is vulnerable to a denial of service, caused by a prototype pollution flaw in qs. By   adding or modifying properties of Object.prototype using a __proto__ or constructor payload, a remote   attacker could exploit this vulnerability to cause a denial of service condition. (CVE-2022-24999)

  - IBM Cognos Analytics is vulnerable to stored cross-site scripting, caused by improper validation of SVG   Files in Custom Visualizations. A remote attacker could exploit this vulnerability to execute scripts in a   victim's Web browser within the security context of the hosting Web site. An attacker could use this   vulnerability to steal the victim's cookie-based authentication credentials. (CVE-2023-28530)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of Primavera Unifier installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2023 CPU advisory.

  - Security-in-Depth issue in the Primavera Unifier product of Oracle Construction and Engineering   (component: User Interface (JSZip)). This vulnerability cannot be exploited in the context of this product.
  (CVE-2022-48285)

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Web   Services (json-smart)). Supported versions that are affected are 21.12.0-21.12.15 and 22.12.0-22.12.6.
  Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise   Primavera Unifier. Successful attacks of this vulnerability can result in unauthorized ability to cause a   hang or frequently repeatable crash (complete DOS) of Primavera Unifier. (CVE-2023-1370)

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Document   Management (Apache Commons FileUpload)). Supported versions that are affected are 18.8.0-18.8.18,   19.12.0-19.12.16, 20.12.0-20.12.16, 21.12.0-21.12.15 and 22.12.0-22.12.6. Easily exploitable vulnerability   allows unauthenticated attacker with network access via HTTP to compromise Primavera Unifier. Successful   attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable   crash (complete DOS) of Primavera Unifier. (CVE-2023-24998)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle WebLogic Server installed on the remote host is missing a security patch from the July 2023 Critical Patch Update (CPU). It is, therefore, affected by multiple vulnerabilities, including:

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Centralized     Third Party Jars (Jettison)). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise     Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized ability to     cause a hang or frequently repeatable crash (complete DOS) of Oracle WebLogic Server. (CVE-2023-1436)

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).     Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability     allows high privileged attacker with network access via multiple protocols to compromise Oracle WebLogic     Server. Successful attacks of this vulnerability can result in unauthorized creation, deletion or     modification access to critical data or all Oracle WebLogic Server accessible data and unauthorized     ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle WebLogic Server.     (CVE-2023-22040)

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Centralized     Thirdparty Jars (NekoHTML)). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise     Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle     WebLogic Server. (CVE-2023-26119)

  Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of Primavera Gateway installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2023 CPU advisory.

  - Vulnerability in the Primavera Gateway product of Oracle Construction and Engineering (component: Admin     (Apache Commons Net)). Supported versions that are affected are 18.8.0-18.8.15, 19.12.0-19.12.16,     20.12.0-20.12.11 and 21.12.0-21.12.9. Easily exploitable vulnerability allows unauthenticated attacker     with network access via HTTP to compromise Primavera Gateway. Successful attacks require human interaction     from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized     access to critical data or complete access to all Primavera Gateway accessible data. (CVE-2021-37533)

  - Vulnerability in the Primavera Gateway product of Oracle Construction and Engineering (component: Admin     (JSZip)). Supported versions that are affected are 18.8.0-18.8.15, 19.12.0-19.12.16, 20.12.0-20.12.11 and     21.12.0-21.12.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via     HTTP to compromise Primavera Gateway. Successful attacks of this vulnerability can result in unauthorized     update, insert or delete access to some of Primavera Gateway accessible data as well as unauthorized read     access to a subset of Primavera Gateway accessible data and unauthorized ability to cause a partial denial     of service (partial DOS) of Primavera Gateway. (CVE-2022-48285)

  - Vulnerability in the Primavera Gateway product of Oracle Construction and Engineering (component: Admin     (json-smart)). Supported versions that are affected are 18.8.0-18.8.15, 19.12.0-19.12.16, 20.12.0-20.12.11     and 21.12.0-21.12.9. Easily exploitable vulnerability allows unauthenticated attacker with network access     via HTTP to compromise Primavera Gateway. Successful attacks of this vulnerability can result in     unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Primavera Gateway.
    (CVE-2023-1370)

  - Vulnerability in the Primavera Gateway product of Oracle Construction and Engineering (component: Admin     (Spring Framework)). Supported versions that are affected are 18.8.0-18.8.15, 19.12.0-19.12.16,     20.12.0-20.12.11 and 21.12.0-21.12.9. Easily exploitable vulnerability allows low privileged attacker with     network access via HTTP to compromise Primavera Gateway. Successful attacks of this vulnerability can     result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Primavera     Gateway. (CVE-2023-20863)


Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6011-1 advisory.

  - A vulnerability was discovered in the indexOf function of JSONParserByteArray in JSON Smart versions 1.3     and 2.4 which causes a denial of service (DOS) via a crafted web request. (CVE-2021-31684)

  - [Json-smart](https://netplex.github.io/json-smart/) is a performance focused, JSON processor lib. When     reaching a [ or { character in the JSON input, the code parses an array or an object respectively. It     was discovered that the code does not have any limit to the nesting of such arrays or objects. Since the     parsing of nested arrays and objects is done recursively, nesting too many of them can cause a stack     exhaustion (stack overflow) and crash the software. (CVE-2023-1370)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-3373 advisory.

  - A vulnerability was discovered in the indexOf function of JSONParserByteArray in JSON Smart versions 1.3     and 2.4 which causes a denial of service (DOS) via a crafted web request. (CVE-2021-31684)

  - [Json-smart](https://netplex.github.io/json-smart/) is a performance focused, JSON processor lib. When     reaching a [ or { character in the JSON input, the code parses an array or an object respectively. It     was discovered that the code does not have any limit to the nesting of such arrays or objects. Since the     parsing of nested arrays and objects is done recursively, nesting too many of them can cause a stack     exhaustion (stack overflow) and crash the software. (CVE-2023-1370)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
194324	RHEL 8 : jenkins and jenkins-2-plugins (RHSA-2023:3610)	Nessus	Red Hat Local Security Checks	critical
194300	RHEL 8 : jenkins and jenkins-2-plugins (RHSA-2023:3622)	Nessus	Red Hat Local Security Checks	critical
194242	RHEL 8 : jenkins and jenkins-2-plugins (RHSA-2023:3663)	Nessus	Red Hat Local Security Checks	critical
194234	RHEL 8 : OpenShift Container Platform 4.10.61 (RHSA-2023:3362)	Nessus	Red Hat Local Security Checks	high
193868	IBM Cognos Analytics 11.1.1 < 11.1.7 FP8 / 11.2.x < 11.2.4 FP3 / 12.0.x < 12.0.2 (7123154)	Nessus	CGI abuses	critical
193571	Oracle Application Testing Suite (April 2024 CPU)	Nessus	Misc.	critical
191754	IBM Engineering Requirements Management DOORS 9.7.2.x < 9.7.2.8 Multiple Vulnerabilities (7124058)	Nessus	Windows	critical
189446	RHCOS 4 : OpenShift Container Platform 4.10.61 (RHSA-2023:3362)	Nessus	Red Hat Local Security Checks	high
186715	Atlassian Jira Service Management Data Center and Server 4.20.x < 4.20.27 / 5.4.x < 5.4.11 (JSDSERVER-14746)	Nessus	Misc.	high
178850	IBM Cognos Analytics Multiple Vulnerabilities (7012621)	Nessus	CGI abuses	medium
178814	Oracle Primavera Unifier (Jul 2023 CPU)	Nessus	CGI abuses	high
178618	Oracle WebLogic Server (July 2023 CPU)	Nessus	Misc.	critical
178484	Oracle Primavera Gateway (Jul 2023 CPU)	Nessus	CGI abuses	high
174172	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : Json-smart vulnerabilities (USN-6011-1)	Nessus	Ubuntu Local Security Checks	high
173721	Debian DLA-3373-1 : json-smart - LTS security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2023-1370

high

Tenable Plugins

critical

critical

critical

high

critical

critical

critical

high

high

medium

high

critical

high

high

high