« Volver al listado

CVE-2022-36423

Estado: ModificadaAlta (7.4)—

OpenHarmony-v3.1.2 and prior versions have an incorrect configuration of the cJSON library, which leads a Stack overflow vulnerability during recursive parsing. LAN attackers can lead a DoS attack to all network devices.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Openatom — OpenharmonyOpenharmony — Openharmony

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-36423",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "scy@openharmony.io",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 7.4,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 4,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 7.4,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "scy@openharmony.io",
      "affectedData": [
        {
          "vendor": "OpenHarmony",
          "product": "OpenHarmony",
          "versions": [
            {
              "status": "affected",
              "version": "OpenHarmony-v3.1.x-Release",
              "versionType": "custom",
              "lessThanOrEqual": "3.1.2"
            },
            {
              "status": "affected",
              "version": "OpenHarmony-v3.0.x-LTS",
              "versionType": "custom",
              "lessThanOrEqual": "3.0.5"
            },
            {
              "status": "affected",
              "version": "OpenHarmony-v1.1.x-LTS",
              "versionType": "custom",
              "lessThanOrEqual": "1.1.5"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-09-09T15:15:10.757",
  "references": [
    {
      "url": "https://gitee.com/openharmony/security/blob/master/en/security-disclosure/2022/2022-09.md",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "scy@openharmony.io"
    },
    {
      "url": "https://gitee.com/openharmony/security/blob/master/en/security-disclosure/2022/2022-09.md",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "scy@openharmony.io",
      "description": [
        {
          "lang": "en",
          "value": "CWE-16"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "OpenHarmony-v3.1.2 and prior versions have an incorrect configuration of the cJSON library, which leads a Stack overflow vulnerability during recursive parsing. LAN attackers can lead a DoS attack to all network devices."
    },
    {
      "lang": "es",
      "value": "OpenHarmony versiones v3.1.2 y anteriores, presentan una configuración incorrecta de la biblioteca cJSON, que conlleva a una vulnerabilidad de desbordamiento de pila durante el análisis recursivo. Los atacantes de la LAN pueden conllevar a un ataque DoS a todos los dispositivos de la red"
    }
  ],
  "lastModified": "2026-06-17T04:53:25.777",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:openharmony:openharmony:*:*:*:*:long_term_support:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8C039CB8-843F-4608-9D51-0723001EFAFB",
              "versionEndIncluding": "1.1.5",
              "versionStartIncluding": "1.1.0"
            },
            {
              "criteria": "cpe:2.3:a:openharmony:openharmony:*:*:*:*:long_term_support:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3375114F-F7BC-4D54-8906-461891AF90FD",
              "versionEndIncluding": "3.0.5",
              "versionStartIncluding": "3.0"
            },
            {
              "criteria": "cpe:2.3:o:openatom:openharmony:*:*:*:*:-:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1851DC7A-A8D5-46D9-BC51-ED8152B8F345",
              "versionEndIncluding": "3.1.2",
              "versionStartIncluding": "3.1"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "scy@openharmony.io"
}