Description

This affects the package json-pointer before 0.6.1. Multiple reference of object using slash is supported.

Remediation

References

https://github.com/manuelstofer/json-pointer/pull/34/files

https://snyk.io/vuln/SNYK-JS-JSONPOINTER-596925

https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-598862

Related Vulnerabilities

CVE-2022-39387 Vulnerability in maven package org.xwiki.contrib.oidc:oidc-authenticator

CVE-2020-5232 Vulnerability in npm package @ensdomains/ens

CVE-2017-1000452 Vulnerability in npm package express-saml2

CVE-2023-46659 Vulnerability in maven package org.jenkins-ci.plugins:trac

CVE-2020-14966 Vulnerability in npm package jsrsasign

Severity

High

Classification

CWE-1321 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Tags

Patch Third Party Advisory Exploit