CVE-2022-36038 - CircuitVerse potential RCE vulnerability via Oj.load

Back Back to CVE browser

HIGH

CircuitVerse potential RCE vulnerability via Oj.load

Published Sep 6, 2022

8.8

HIGH

CVSS 3.1

EPSS 1.14%

Description

CircuitVerse is an open-source platform which allows users to construct digital logic circuits online. A remote code execution (RCE) vulnerability in CircuitVerse allows authenticated attackers to execute arbitrary code via specially crafted JSON payloads. This issue may lead to Remote Code Execution (RCE). A patch is available in commit number 7b3023a99499a7675f10f2c1d9effdf10c35fb6e. There are currently no known workarounds.

Affected products

Vendor CircuitVerse Product CircuitVerse Default
n/a
- Version
  < 7b3023a99499a7675f10f2c1d9effdf10c35fb6e
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

CircuitVerse

n/a

Version	Status	Constraints
< 7b3023a99499a7675f10f2c1d9effdf10c35fb6e	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-502

Deserialization of Untrusted Data

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-38811
Advisory
https://github.com/CircuitVerse/CircuitVerse/commit/7b3023a99499a7675f10f2c1d9effdf10c35fb6e
x_refsource_MISCPatchThird Party Advisory
https://github.com/CircuitVerse/CircuitVerse/security/advisories/GHSA-8c8q-4h7g-4rp3
x_refsource_CONFIRMPatchThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-38811		Advisory
https://github.com/CircuitVerse/CircuitVerse/commit/7b3023a99499a7675f10f2c1d9effdf10c35fb6e		x_refsource_MISCPatchThird Party Advisory
https://github.com/CircuitVerse/CircuitVerse/security/advisories/GHSA-8c8q-4h7g-4rp3		x_refsource_CONFIRMPatchThird Party Advisory