ByteOS Network

NVD Vulnerability Details :

CVE-2022-41875

Analyzed

Source-security-advisories@github.com

Published At-23 Nov, 2022 | 19:15

Updated At-30 Nov, 2022 | 16:07

A remote code execution (RCE) vulnerability in Optica allows unauthenticated attackers to execute arbitrary code via specially crafted JSON payloads. Specially crafted JSON payloads may lead to RCE (remote code execution) on the attacked system running Optica. The vulnerability was patched in v. 0.10.2, where the call to the function `oj.load` was changed to `oj.safe_load`.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Secondary	3.1	10.0	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CPE Matches

airbnb>>optica>>Versions before 0.10.2(exclusive)

cpe:2.3:a:airbnb:optica:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-502	Primary	security-advisories@github.com

References

Hyperlink	Source	Resource
https://github.com/airbnb/optica/security/advisories/GHSA-cf87-4h6x-phh6	security-advisories@github.com	Third Party Advisory
https://github.com/ohler55/oj/blob/develop/pages/Security.md	security-advisories@github.com	Third Party Advisory
https://www.rubydoc.info/gems/oj/3.0.2/Oj.safe_load	security-advisories@github.com	Release Notes Vendor Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History