Django REST framework

Lookup for vulnerabilities affecting packages.

Vulnerability_id VCID-b9ek-rpag-ryen

Summary

Improper Input Validation
Fastjson allows remote attackers to execute arbitrary code via a crafted JSON request, as demonstrated by a crafted `rmi://` URI in the `dataSourceName` field of HTTP POST data to the Pippo `/json` URI, which is mishandled in `AjaxApplication.java`.

Aliases

alias	CVE-2017-18349

alias	GHSA-xjrr-xv9m-4pw5

Fixed_packages

url	pkg:maven/com.alibaba/fastjson@1.2.25
purl	pkg:maven/com.alibaba/fastjson@1.2.25
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:maven/com.alibaba/fastjson@1.2.25

url	pkg:maven/ro.pippo/pippo-fastjson@1.12.0
purl	pkg:maven/ro.pippo/pippo-fastjson@1.12.0
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:maven/ro.pippo/pippo-fastjson@1.12.0

Affected_packages

References

reference_url	https://fortiguard.com/encyclopedia/ips/44059
reference_id
reference_type
scores
url	https://fortiguard.com/encyclopedia/ips/44059

reference_url	https://github.com/alibaba/fastjson/wiki/security_update_20170315
reference_id
reference_type
scores
url	https://github.com/alibaba/fastjson/wiki/security_update_20170315

reference_url	https://github.com/pippo-java/pippo/commit/8443377d3c5b35acca190a66894b4f95e4051be2
reference_id
reference_type
scores
url	https://github.com/pippo-java/pippo/commit/8443377d3c5b35acca190a66894b4f95e4051be2

reference_url	https://github.com/pippo-java/pippo/issues/466
reference_id
reference_type
scores
url	https://github.com/pippo-java/pippo/issues/466

reference_url	https://nvd.nist.gov/vuln/detail/CVE-2017-18349
reference_id	CVE-2017-18349
reference_type
scores
url	https://nvd.nist.gov/vuln/detail/CVE-2017-18349

reference_url	https://github.com/advisories/GHSA-xjrr-xv9m-4pw5
reference_id	GHSA-xjrr-xv9m-4pw5
reference_type
scores
url	https://github.com/advisories/GHSA-xjrr-xv9m-4pw5

Weaknesses

cwe_id	1035
name	OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.

cwe_id	20
name	Improper Input Validation
description	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

cwe_id	937
name	OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.

cwe_id	78
name	Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
description	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Exploits

Severity_range_score null

Exploitability null

Weighted_severity null

Risk_score null

Resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-b9ek-rpag-ryen

Vulnerability Instance