CVE-2021-31875 - CVE House
Back to Database
Status published Critical CVE-2021-31875

In mjs_json.c in Cesanta MongooseOS mJS 1.26, a maliciously formed...

Vulnerability Description

In mjs_json.c in Cesanta MongooseOS mJS 1.26, a maliciously formed JSON string can trigger an off-by-one heap-based buffer overflow in mjs_json_parse, which can potentially lead to redirection of control flow. NOTE: the original reporter disputes the significance of this finding because "there isn’t very much of an opportunity to exploit this reliably for an information leak, so there isn’t any real security impact."

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-31875

Credits & Attribution

No credits recorded in the NVD database.

References

More from cesanta

View All →
CVE-2021-46556
Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability...
Medium 5.5
CVE-2021-46554
Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability...
Medium 5.5
CVE-2021-46553
Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability...
Medium 5.5
CVE-2021-46550
Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability...
Medium 5.5
CVE-2021-46549
Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability...
Medium 5.5

Affected Vendor

Affected Software

mongooseos mjs
Vulnerable Versions:
1.26

Timeline

Official Publish: April 29th, 2021
Last Modified: August 3rd, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.