{"id":"EUVD-2021-0917","enisaUuid":"547b8407-4236-3a66-868d-e21c5648db6f","description":"This affects the package json before 10.0.0. It is possible to inject arbritary commands using the parseLookup function.","datePublished":"Aug 30, 2020, 7:15:16 AM","dateUpdated":"Oct 8, 2026, 9:03:32 PM","baseScore":7.2,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","references":"https://snyk.io/vuln/SNYK-JS-JSON-597481\nhttps://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-608931\nhttps://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-608932\nhttps://github.com/trentm/json/issues/144\nhttps://github.com/trentm/json/pull/145\nhttps://lists.apache.org/thread.html/r8d2e174230f6d26e16c007546e804c343f1f68956f526daaafa4aaae%40%3Cdev.zookeeper.apache.org%3E\nhttps://lists.apache.org/thread.html/rd9b9cc843f5cf5b532bdad9e87a817967efcf52b917e8c43b6df4cc7%40%3Cissues.zookeeper.apache.org%3E\nhttps://lists.apache.org/thread.html/ree3abcd33c06ee95ab59faa1751198a1186d8941ddc2c2562c12966c%40%3Cissues.zookeeper.apache.org%3E\nhttps://lists.apache.org/thread.html/rb023d54a46da1ac0d8969097f5fecc79636b07d3b80db7b818a5c55c%40%3Cissues.zookeeper.apache.org%3E\nhttps://lists.apache.org/thread.html/rb2b981912446a74e14fe6076c4b7c7d8502727ea0718e6a65a9b1be5%40%3Cissues.zookeeper.apache.org%3E\nhttps://lists.apache.org/thread.html/r9c6d28e5b9a9b3481b7d1f90f1c2f75cd1a5ade91038426e0fb095da%40%3Cdev.flink.apache.org%3E\nhttps://lists.apache.org/thread.html/r977a907ecbedf87ae5ba47d4c77639efb120f74d4d1b3de14a4ef4da%40%3Cissues.flink.apache.org%3E\nhttps://lists.apache.org/thread.html/r5f17bfca1d6e7f4b33ae978725b2fd62a9f1b3111696eafa9add802d%40%3Cissues.zookeeper.apache.org%3E\nhttps://lists.apache.org/thread.html/ra890c24b3d90be36daf48ae76b263acb297003db24c1122f8e4aaef2%40%3Cissues.flink.apache.org%3E\nhttps://lists.apache.org/thread.html/rba7ea4d75d6a8e5b935991d960d9b893fd30e576c4d3b531084ebd7d%40%3Cissues.flink.apache.org%3E\nhttps://lists.apache.org/thread.html/rb89bd82dffec49f83b49e9ad625b1b63a408b3c7d1a60d6f049142a0%40%3Cissues.flink.apache.org%3E\nhttps://lists.apache.org/thread.html/rec8bb4d637b04575da41cfae49118e108e95d43bfac39b7b698ee4db%40%3Cissues.zookeeper.apache.org%3E\nhttps://lists.apache.org/thread.html/r37c0e1807da7ff2bdd028bbe296465a6bbb99e2320dbe661d5d8b33b%40%3Cissues.zookeeper.apache.org%3E\nhttps://lists.apache.org/thread.html/r3b04f4e99a19613f88ae088aa18cd271231a3c79dfff8f5efa8cda61%40%3Cissues.zookeeper.apache.org%3E\nhttps://www.oracle.com//security-alerts/cpujul2021.html\nhttps://www.oracle.com/security-alerts/cpujan2022.html\nhttps://www.oracle.com/security-alerts/cpujul2022.html\n","aliases":"CVE-2020-7712\nGHSA-3c6g-pvg8-gqw2\n","assigner":"snyk","epss":3.11,"enisaIdProduct":[{"id":"d590d096-a7cc-319e-b7a9-9e559a185f7e","product":{"name":"json","vendor":{"name":"Ruby"}},"product_version":"unspecified \u003c10.0.0"}],"enisaIdVendor":[{"id":"69838cf5-355d-36d0-a304-d972b3c36679","vendor":{"name":"n/a"}}],"enisaIdVulnerability":[{"id":"a6a77783-de57-3814-a417-62d69d18f398","vulnerability":{"id":"GHSA-3c6g-pvg8-gqw2","description":"trentm/json vulnerable to command injection","datePublished":"May 6, 2021, 6:11:21 PM","dateUpdated":"Sep 11, 2023, 8:29:18 PM","baseScore":null,"references":"https://nvd.nist.gov/vuln/detail/CVE-2020-7712\nhttps://github.com/trentm/json/issues/144\nhttps://github.com/trentm/json/pull/145\nhttps://github.com/trentm/json/commit/cc4798169f9e0f181f8aa61905b88479badcd483\nhttps://www.oracle.com/security-alerts/cpujul2022.html\nhttps://www.oracle.com/security-alerts/cpujan2022.html\nhttps://www.oracle.com//security-alerts/cpujul2021.html\nhttps://snyk.io/vuln/SNYK-JS-JSON-597481\nhttps://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-608931\nhttps://lists.apache.org/thread.html/ree3abcd33c06ee95ab59faa1751198a1186d8941ddc2c2562c12966c@%3Cissues.zookeeper.apache.org%3E\nhttps://lists.apache.org/thread.html/rec8bb4d637b04575da41cfae49118e108e95d43bfac39b7b698ee4db@%3Cissues.zookeeper.apache.org%3E\nhttps://lists.apache.org/thread.html/rd9b9cc843f5cf5b532bdad9e87a817967efcf52b917e8c43b6df4cc7@%3Cissues.zookeeper.apache.org%3E\nhttps://lists.apache.org/thread.html/rba7ea4d75d6a8e5b935991d960d9b893fd30e576c4d3b531084ebd7d@%3Cissues.flink.apache.org%3E\nhttps://lists.apache.org/thread.html/rb89bd82dffec49f83b49e9ad625b1b63a408b3c7d1a60d6f049142a0@%3Cissues.flink.apache.org%3E\nhttps://lists.apache.org/thread.html/rb2b981912446a74e14fe6076c4b7c7d8502727ea0718e6a65a9b1be5@%3Cissues.zookeeper.apache.org%3E\nhttps://lists.apache.org/thread.html/rb023d54a46da1ac0d8969097f5fecc79636b07d3b80db7b818a5c55c@%3Cissues.zookeeper.apache.org%3E\nhttps://lists.apache.org/thread.html/ra890c24b3d90be36daf48ae76b263acb297003db24c1122f8e4aaef2@%3Cissues.flink.apache.org%3E\nhttps://lists.apache.org/thread.html/r9c6d28e5b9a9b3481b7d1f90f1c2f75cd1a5ade91038426e0fb095da@%3Cdev.flink.apache.org%3E\nhttps://lists.apache.org/thread.html/r977a907ecbedf87ae5ba47d4c77639efb120f74d4d1b3de14a4ef4da@%3Cissues.flink.apache.org%3E\nhttps://lists.apache.org/thread.html/r8d2e174230f6d26e16c007546e804c343f1f68956f526daaafa4aaae@%3Cdev.zookeeper.apache.org%3E\nhttps://lists.apache.org/thread.html/r5f17bfca1d6e7f4b33ae978725b2fd62a9f1b3111696eafa9add802d@%3Cissues.zookeeper.apache.org%3E\nhttps://lists.apache.org/thread.html/r3b04f4e99a19613f88ae088aa18cd271231a3c79dfff8f5efa8cda61@%3Cissues.zookeeper.apache.org%3E\nhttps://lists.apache.org/thread.html/r37c0e1807da7ff2bdd028bbe296465a6bbb99e2320dbe661d5d8b33b@%3Cissues.zookeeper.apache.org%3E\nhttps://github.com/trentm/json\n","enisa_id":"EUVD-2021-0917\n","aliases":"GHSA-3c6g-pvg8-gqw2\nCVE-2020-7712\n","epss":0.0,"dataProcessed":"May 3, 2026, 1:44:37 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"d2c88db4-539b-3e6b-a44f-856680f3bc13","vulnerability":{"id":"CVE-2020-7712","description":"This affects the package json before 10.0.0. It is possible to inject arbritary commands using the parseLookup function.","datePublished":"Aug 30, 2020, 7:15:16 AM","dateUpdated":"Oct 8, 2026, 9:03:32 PM","status":"PUBLISHED","baseScore":7.2,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","references":"https://snyk.io/vuln/SNYK-JS-JSON-597481\nhttps://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-608931\nhttps://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-608932\nhttps://github.com/trentm/json/issues/144\nhttps://github.com/trentm/json/pull/145\nhttps://lists.apache.org/thread.html/r8d2e174230f6d26e16c007546e804c343f1f68956f526daaafa4aaae%40%3Cdev.zookeeper.apache.org%3E\nhttps://lists.apache.org/thread.html/rd9b9cc843f5cf5b532bdad9e87a817967efcf52b917e8c43b6df4cc7%40%3Cissues.zookeeper.apache.org%3E\nhttps://lists.apache.org/thread.html/ree3abcd33c06ee95ab59faa1751198a1186d8941ddc2c2562c12966c%40%3Cissues.zookeeper.apache.org%3E\nhttps://lists.apache.org/thread.html/rb023d54a46da1ac0d8969097f5fecc79636b07d3b80db7b818a5c55c%40%3Cissues.zookeeper.apache.org%3E\nhttps://lists.apache.org/thread.html/rb2b981912446a74e14fe6076c4b7c7d8502727ea0718e6a65a9b1be5%40%3Cissues.zookeeper.apache.org%3E\nhttps://lists.apache.org/thread.html/r9c6d28e5b9a9b3481b7d1f90f1c2f75cd1a5ade91038426e0fb095da%40%3Cdev.flink.apache.org%3E\nhttps://lists.apache.org/thread.html/r977a907ecbedf87ae5ba47d4c77639efb120f74d4d1b3de14a4ef4da%40%3Cissues.flink.apache.org%3E\nhttps://lists.apache.org/thread.html/r5f17bfca1d6e7f4b33ae978725b2fd62a9f1b3111696eafa9add802d%40%3Cissues.zookeeper.apache.org%3E\nhttps://lists.apache.org/thread.html/ra890c24b3d90be36daf48ae76b263acb297003db24c1122f8e4aaef2%40%3Cissues.flink.apache.org%3E\nhttps://lists.apache.org/thread.html/rba7ea4d75d6a8e5b935991d960d9b893fd30e576c4d3b531084ebd7d%40%3Cissues.flink.apache.org%3E\nhttps://lists.apache.org/thread.html/rb89bd82dffec49f83b49e9ad625b1b63a408b3c7d1a60d6f049142a0%40%3Cissues.flink.apache.org%3E\nhttps://lists.apache.org/thread.html/rec8bb4d637b04575da41cfae49118e108e95d43bfac39b7b698ee4db%40%3Cissues.zookeeper.apache.org%3E\nhttps://lists.apache.org/thread.html/r37c0e1807da7ff2bdd028bbe296465a6bbb99e2320dbe661d5d8b33b%40%3Cissues.zookeeper.apache.org%3E\nhttps://lists.apache.org/thread.html/r3b04f4e99a19613f88ae088aa18cd271231a3c79dfff8f5efa8cda61%40%3Cissues.zookeeper.apache.org%3E\nhttps://www.oracle.com//security-alerts/cpujul2021.html\nhttps://www.oracle.com/security-alerts/cpujan2022.html\nhttps://www.oracle.com/security-alerts/cpujul2022.html\n","enisa_id":"EUVD-2021-0917\n","assigner":"snyk","epss":3.11,"dataProcessed":"Nov 8, 2026, 1:27:05 AM","vulnerabilityProduct":[{"id":"5f035e4c-fbc1-3e47-83fe-287613590ba0","product":{"name":"json","vendor":{"name":"Ruby"}},"product_version":"unspecified \u003c10.0.0"}],"vulnerabilityVendor":[{"id":"6121b012-73ec-305d-987d-04e587d6d644","vendor":{"name":"n/a"}}]}}],"enisaIdAdvisory":[{"id":"f9a3cc53-53d3-371a-b50c-8fff915b901c","advisory":{"id":"WID-SEC-W-2023-1030","description":"Oracle Siebel CRM: Mehrere Schwachstellen","summary":"Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Siebel CRM ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.","datePublished":"Apr 18, 2023, 10:00:00 PM","dateUpdated":"Apr 18, 2023, 10:00:00 PM","baseScore":0.0,"references":"https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-1030.json\nhttps://wid.cert-bund.de/portal/wid/securityadvisory?name\u003dWID-SEC-2023-1030\n","aliases":"CVE-2023-21909\nCVE-2022-42252\nCVE-2022-42003\nCVE-2021-37695\nCVE-2021-3712\nCVE-2020-7712\n","source":{"id":8,"name":"csaf_certbund"},"advisoryProduct":[{"id":"33143717-675e-3391-b276-57a123cdc1d1","product":{"name":"Oracle Siebel CRM \u003c\u003d 21.10","vendor":{"name":"Oracle"}}},{"id":"5f3d5e4f-129c-356e-9fc0-cd377ff2b0e9","product":{"name":"Oracle Siebel CRM \u003c\u003d 22.5","vendor":{"name":"Oracle"}}},{"id":"84f17bd4-eb00-37f2-8e64-cc0fb898cb4c","product":{"name":"Oracle Siebel CRM \u003c\u003d 23.2","vendor":{"name":"Oracle"}}},{"id":"9ded6f55-ab43-3f82-b12b-24791d7c57a1","product":{"name":"Oracle Siebel CRM \u003c\u003d 22.10","vendor":{"name":"Oracle"}}},{"id":"b7c086f6-bb9f-3319-8b68-203f85123104","product":{"name":"Oracle Siebel CRM \u003c\u003d 23.3","vendor":{"name":"Oracle"}}},{"id":"f09789b8-7aee-35ec-a9d8-8041401a5a84","product":{"name":"Siebel CRM","vendor":{"name":"Oracle"}}}]}}]}