Arbitrary Addition Creation Affecting json package, versions >=1.7.0, <1.7.7


0.0
critical

Snyk CVSS

    Attack Complexity Low
    Confidentiality High
    Integrity High

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-RUBY-JSON-20056
  • published 3 Feb 2013
  • disclosed 3 Feb 2013
  • credit Steve Root

Introduced: 3 Feb 2013

CVE NOT AVAILABLE CWE-284 Open this link in a new tab

Overview

The json gem is a JSON implementation as a Ruby extension in C.

Affected versions of this gem contain a vulnerability in the JSON::GenericObject function which does not restrict users from creating additions, regardless of the state of create_additions. This may allow a remote attacker to create arbitrary additions.