CVE-2021-3822: jsoneditor is vulnerable to Inefficient Regular Expression Complexity

High severity · published Sep 27, 2021

CVE-2021-3822

jsoneditor is vulnerable to Inefficient Regular Expression Complexity

7.5

CVSS

1.4%

EPSS

On KEV

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

None

Integrity

None

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)1.4% · higher than 73% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Jsoneditor · Jsoneditoronline

before 9.5.6 · source: NVD

Affected product

Jsoneditor

Jsoneditoronline

All Jsoneditor CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2021-3822

CVE.org

https://www.cve.org/CVERecord?id=CVE-2021-3822

Patch

https://github.com/josdejong/jsoneditor/commit/092e386cf49f2a1450625617da8e0137ed067c3e

Exploit

https://huntr.dev/bounties/1e3ed803-b7ed-42f1-a4ea-c4c75da9de73