Security readout for executives and security teams
Plain-English summary
MojoJson v1.2.3 is reported to allow arbitrary code execution through its destroy function. The CVSS 9.8 rating indicates potential full confidentiality, integrity, and availability impact if vulnerable code is reachable. The public record has limited affected-product metadata, so organizations need to confirm local use before deciding urgency.
Executive priority
Treat this as high-priority for teams that may use MojoJson. The rating is critical, but the public evidence is sparse; prioritize rapid inventory, reachability review, and replacement or vendor-guidance tracking.
Technical view
The CVE description identifies MojoJson v1.2.3 and the destroy function as the vulnerable area. The record lists CWE-476, while the description claims arbitrary code execution. No CPEs, vendor advisory, fixed version, or detailed impact conditions are provided in the source bundle.
Likely exposure
Exposure is likely limited to applications or services that include MojoJson v1.2.3 and process attacker-controlled data through the affected functionality. The CVE affected-product fields are marked n/a, so software inventory verification is required.
Exploitation context
The CVE is not listed as CISA KEV in the provided bundle, and no cited source confirms active exploitation. The network, unauthenticated CVSS vector suggests the issue could be serious if the vulnerable path is remotely reachable.
Researcher notes
The source bundle contains a short CVE description and one GitHub issue reference. There is a mismatch between CWE-476 and the stated arbitrary code execution impact. Avoid assuming affected platforms, exploit maturity, or remediation details beyond the cited records.
Mitigation direction
- Check the MojoJson project and CVE references for vendor guidance or a fixed release.
- Inventory applications and dependency manifests for MojoJson v1.2.3.
- Replace or remove MojoJson v1.2.3 where feasible until authoritative guidance is confirmed.
- Reduce exposure of services parsing untrusted JSON through this dependency.
- Monitor the GitHub issue and CVE record for updates.
Validation and detection
- Search source repositories and build artifacts for MojoJson v1.2.3 references.
- Confirm whether runtime code invokes the affected destroy function path.
- Review internet-facing services for use of this JSON parsing component.
- Check whether dependency scanners recognize CVE-2023-23087 in deployed builds.
- Document uncertainty where version, reachability, or fix status cannot be confirmed.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-476: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2023-23087 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/scottcgi/MojoJson/issues/3CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
NULL Pointer Dereference
NULL Pointer Dereference represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.