{"id":"CVE-2021-27568","aliases":["EUVD-2021-1405","GHSA-v528-7hrm-frqp"],"status":"published","title":"Improper Check for Unusual or Exceptional Conditions in json-smart","description":"An issue was discovered in netplex json-smart-v1 through 2015-10-23 and json-smart-v2 through 2.4. An exception is thrown from a function, but it is not caught, as demonstrated by NumberFormatException. When it is not caught, it may cause programs using the library to crash or expose sensitive information.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.02886,"percentile":0.8707,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-754"],"published":"2021-02-23T01:32:14Z","modified":"2026-10-20T10:53:41Z","exploits":[{"source":"pocgithub","id":"arsalanraja987/java-insecure-random-cve-2021-27568","title":"arsalanraja987/java-insecure-random-cve-2021-27568","date":"2025-07-07","url":"https://github.com/arsalanraja987/java-insecure-random-cve-2021-27568"}],"fixes":[{"ecosystem":"Maven","package":"net.minidev:json-smart","fixed_in":["1.3.2","2.4.1","2.3.1"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"net.minidev:json-smart-mini","fixed_in":["1.3.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"net.minidev:json-smart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"net.minidev:json-smart-mini","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"net.minidev:json-smart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.0"},{"fixed":"2.4.1"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"net.minidev:json-smart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.3.1"}]}]},{"source":"osv","ecosystem":"Maven","package":"net.minidev:json-smart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2"}]}],"versions":["1.0.6.3","1.0.8","1.0.9","1.0.9-1","1.1","1.1.1","1.2","1.3","1.3.1"]},{"source":"osv","ecosystem":"Maven","package":"net.minidev:json-smart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.0"},{"fixed":"2.4.1"}]}]},{"source":"osv","ecosystem":"Maven","package":"net.minidev:json-smart-mini","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2"}]}],"versions":["1.0.6.3","1.0.8"]},{"source":"osv","ecosystem":"Maven","package":"net.minidev:json-smart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.3.1"}]}],"versions":["2.0","2.1.0","2.1.1","2.2","2.2.1","2.3"]}],"products":[{"vendor":"json-smart_project","product":"json-smart-v1"},{"vendor":"json-smart_project","product":"json-smart-v2"},{"vendor":"oracle","product":"communications_cloud_native_core_policy"},{"vendor":"oracle","product":"oss_support_tools"},{"vendor":"oracle","product":"peoplesoft_enterprise_peopletools"},{"vendor":"oracle","product":"utilities_framework"},{"vendor":"oracle","product":"weblogic_server"}],"references":[{"url":"https://github.com/netplex/json-smart-v1/issues/7","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web"]},{"url":"https://github.com/netplex/json-smart-v2/issues/60","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web"]},{"url":"https://lists.apache.org/thread.html/rf70210b4d63191c0bfb2a0d5745e104484e71703bf5ad9cb01c980c6%40%3Ccommits.druid.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/re237267da268c690df5e1c6ea6a38a7fc11617725e8049490f58a6fa%40%3Ccommits.druid.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rb6287f5aa628c8d9af52b5401ec6cc51b6fc28ab20d318943453e396%40%3Ccommits.druid.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://www.oracle.com//security-alerts/cpujul2021.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-27568","tags":["advisory"]},{"url":"https://github.com/netplex/json-smart-v1/commit/768db58ee0e3e344fcdb574b7629765308a1d0af","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rf70210b4d63191c0bfb2a0d5745e104484e71703bf5ad9cb01c980c6@%3Ccommits.druid.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rb6287f5aa628c8d9af52b5401ec6cc51b6fc28ab20d318943453e396@%3Ccommits.druid.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/re237267da268c690df5e1c6ea6a38a7fc11617725e8049490f58a6fa@%3Ccommits.druid.apache.org%3E","tags":["web"]},{"url":"https://github.com/netplex/json-smart-v2/issues/62","tags":["web"]},{"url":"https://github.com/netplex/json-smart-v2/pull/72","tags":["web"]},{"url":"https://github.com/advisories/GHSA-v528-7hrm-frqp"},{"url":"https://github.com/netplex/json-smart-v2","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2021-27568","description":"An issue was discovered in netplex json-smart-v1 through 2015-10-23 and json-smart-v2 through 2.4. An exception is thrown from a function, but it is not caught, as demonstrated by NumberFormatException. When it is not caught, it may cause programs using the library to crash or expose sensitive information.","status":"published","published":"2021-02-23T01:32:14Z","modified":"2026-10-08T21:24:17.193Z","updated_at":"2026-11-02T14:33:04.679189Z"}],"euvd":[{"id":"EUVD-2021-1405","description":"An issue was discovered in netplex json-smart-v1 through 2015-10-23 and json-smart-v2 through 2.4. An exception is thrown from a function, but it is not caught, as demonstrated by NumberFormatException. When it is not caught, it may cause programs using the library to crash or expose sensitive information.","status":"published","published":"2021-02-23T01:32:14Z","modified":"2026-10-08T21:24:17Z","updated_at":"2026-11-02T17:27:25.942984Z"}],"ghsa":[{"id":"GHSA-v528-7hrm-frqp","title":"Improper Check for Unusual or Exceptional Conditions in json-smart","description":"An issue was discovered in netplex json-smart-v1 through 2015-10-23 and json-smart-v2 through 2.4. An exception is thrown from a function, but it is not caught, as demonstrated by NumberFormatException. When it is not caught, it may cause programs using the library to crash or expose sensitive information.","status":"published","published":"2021-06-16T18:03:47Z","modified":"2023-02-15T18:39:28Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-754"],"updated_at":"2026-11-02T14:36:45.67005Z"}],"nvd":[{"id":"CVE-2021-27568","description":"An issue was discovered in netplex json-smart-v1 through 2015-10-23 and json-smart-v2 through 2.4. An exception is thrown from a function, but it is not caught, as demonstrated by NumberFormatException. When it is not caught, it may cause programs using the library to crash or expose sensitive information.","status":"published","published":"2021-02-23T02:15:12.887Z","modified":"2026-10-08T22:17:08.57Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-754"],"updated_at":"2026-11-02T14:06:50.031227Z"}],"osv":[{"id":"CVE-2021-27568","description":"An issue was discovered in netplex json-smart-v1 through 2015-10-23 and json-smart-v2 through 2.4. An exception is thrown from a function, but it is not caught, as demonstrated by NumberFormatException. When it is not caught, it may cause programs using the library to crash or expose sensitive information.","status":"published","published":"2021-02-23T02:15:12.887Z","modified":"2026-10-20T10:53:41.976989937Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:19.129331Z"},{"id":"GHSA-v528-7hrm-frqp","title":"Improper Check for Unusual or Exceptional Conditions in json-smart","description":"An issue was discovered in netplex json-smart-v1 through 2015-10-23 and json-smart-v2 through 2.4. An exception is thrown from a function, but it is not caught, as demonstrated by NumberFormatException. When it is not caught, it may cause programs using the library to crash or expose sensitive information.","status":"published","published":"2021-06-16T18:03:47Z","modified":"2026-09-10T03:49:06.498765291Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-754"],"updated_at":"2026-11-02T15:46:56.639206Z"}]}}