CVE-2022-48623

The Cpanel::JSON::XS package before 4.33 for Perl performs out-of-bounds accesses in a way that allows attackers to obtain sensitive information or cause a…

Critical · published February 13, 2024

CVSS v3.1
9.1
EPSS
1%
Percentile
55.7
In the wild
Unconfirmed
What it is

🚨 A sneaky out-of-bounds access in the Cpanel::JSON::XS package could expose sensitive data or crash your system—it's like letting a raccoon rummage through your pantry! 🔥 Think of it like a delivery driver who misreads an address and ends up in your neighbor's yard instead of yours—uninvited and causing chaos. If you're not careful, that driver can peek into your home or knock things over! An attacker exploiting this flaw could gain access to sensitive information or cause a denial of service, leaving your application stranded and your users frustrated. Imagine your site going down right when customers need it most—absolutely devastating!

Put simply

Think of it like a delivery driver who misreads an address and ends up in your neighbor's yard instead of yours—uninvited and causing chaos. If you're not careful, that driver can peek into your home or knock things over! This vulnerability occurs due to out-of-bounds accesses in the Cpanel::JSON::XS package prior to version 4.33, enabling attackers to read unintended memory locations, which can lead to sensitive data exposure or application crashes.

What to do

An attacker exploiting this flaw could gain access to sensitive information or cause a denial of service, leaving your application stranded and your users frustrated. Imagine your site going down right when customers need it most—absolutely devastating! Upgrade the Cpanel::JSON::XS package to version 4.33 or later to patch this critical flaw. Additionally, audit your system for any instances of this package and ensure your Perl environment is secure. You've got this! With these steps, you can bolster your defenses and keep your data safe! 🛡️

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00788 · 55.7th percentile
Published
2024-02-13T00:00Z
EPSS history
Timeline
  • 13 FEB 00:00Z
    The Cpanel::JSON::XS package before 4.33 for Perl performs out-of-bounds accesses in a way that allows attackers to obtain sensitive information or cause a…
    cvelistv5