CVE-2017-3936 - Vulnerability Details

Vendors	Products
Mcafee	Epolicy Orchestrator

Link	Providers
http://www.securityfocus.com/bid/103155
https://kc.mcafee.com/corporate/index?page=content&id=SB10227

Show plain JSON

{"containers": {"cna": {"affected": [{"platforms": ["x86"], "product": "ePolicy Orchestrator (ePO)", "vendor": "McAfee", "versions": [{"lessThan": "5.3.3", "status": "affected", "version": "5.1", "versionType": "custom"}, {"lessThan": "5.3.3", "status": "affected", "version": "5.3", "versionType": "custom"}, {"lessThan": "5.9.1", "status": "affected", "version": "5.9", "versionType": "custom"}]}], "datePublic": "2018-02-23T00:00:00", "descriptions": [{"lang": "en", "value": "OS Command Injection vulnerability in McAfee ePolicy Orchestrator (ePO) 5.9.0, 5.3.2, 5.3.1, 5.1.3, 5.1.2, 5.1.1, and 5.1.0 allows attackers to run arbitrary OS commands with limited privileges via not sanitizing the user input data before exporting it into a CSV format output."}], "metrics": [{"cvssV3_0": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 6.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.0"}}], "problemTypes": [{"descriptions": [{"description": "OS Command Injection vulnerability", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-06-14T09:57:01", "orgId": "01626437-bf8f-4d1c-912a-893b5eb04808", "shortName": "trellix"}, "references": [{"name": "103155", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/103155"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://kc.mcafee.com/corporate/index?page=content&id=SB10227"}], "source": {"advisory": "SB10227", "discovery": "INTERNAL"}, "title": "McAfee ePolicy Orchestrator (ePO) - OS Command Injection vulnerability", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "psirt@mcafee.com", "ID": "CVE-2017-3936", "STATE": "PUBLIC", "TITLE": "McAfee ePolicy Orchestrator (ePO) - OS Command Injection vulnerability"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "ePolicy Orchestrator (ePO)", "version": {"version_data": [{"affected": "<", "platform": "x86", "version_affected": "<", "version_name": "5.1", "version_value": "5.3.3"}, {"affected": "<", "platform": "x86", "version_affected": "<", "version_name": "5.3", "version_value": "5.3.3"}, {"affected": "<", "platform": "x86", "version_affected": "<", "version_name": "5.9", "version_value": "5.9.1"}]}}]}, "vendor_name": "McAfee"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "OS Command Injection vulnerability in McAfee ePolicy Orchestrator (ePO) 5.9.0, 5.3.2, 5.3.1, 5.1.3, 5.1.2, 5.1.1, and 5.1.0 allows attackers to run arbitrary OS commands with limited privileges via not sanitizing the user input data before exporting it into a CSV format output."}]}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 6.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.0"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "OS Command Injection vulnerability"}]}]}, "references": {"reference_data": [{"name": "103155", "refsource": "BID", "url": "http://www.securityfocus.com/bid/103155"}, {"name": "https://kc.mcafee.com/corporate/index?page=content&id=SB10227", "refsource": "CONFIRM", "url": "https://kc.mcafee.com/corporate/index?page=content&id=SB10227"}]}, "source": {"advisory": "SB10227", "discovery": "INTERNAL"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T14:39:41.148Z"}, "title": "CVE Program Container", "references": [{"name": "103155", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/103155"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://kc.mcafee.com/corporate/index?page=content&id=SB10227"}]}]}, "cveMetadata": {"assignerOrgId": "01626437-bf8f-4d1c-912a-893b5eb04808", "assignerShortName": "trellix", "cveId": "CVE-2017-3936", "datePublished": "2018-06-13T21:00:00", "dateReserved": "2016-12-26T00:00:00", "dateUpdated": "2024-08-05T14:39:41.148Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{

containers : { »

cna : { »

affected : [ »

0 : { »

platforms : [ »

0 : x86 (string)

]

product : ePolicy Orchestrator (ePO) (string)

vendor : McAfee (string)

versions : [ »

0 : { »

lessThan : 5.3.3 (string)

status : affected (string)

version : 5.1 (string)

versionType : custom (string)

}

1 : { »

lessThan : 5.3.3 (string)

status : affected (string)

version : 5.3 (string)

versionType : custom (string)

}

2 : { »

lessThan : 5.9.1 (string)

status : affected (string)

version : 5.9 (string)

versionType : custom (string)

}

]

}

]

datePublic : 2018-02-23T00:00:00 (string)

descriptions : [ »

0 : { »

lang : en (string)

value : OS Command Injection vulnerability in McAfee ePolicy Orchestrator (ePO) 5.9.0, 5.3.2, 5.3.1, 5.1.3, 5.1.2, 5.1.1, and 5.1.0 allows attackers to run arbitrary OS commands with limited privileges via not sanitizing the user input data before exporting it into a CSV format output. (string)

}

]

metrics : [ »

0 : { »

cvssV3_0 : { »

attackComplexity : LOW (string)

attackVector : LOCAL (string)

availabilityImpact : NONE (string)

baseScore : 6.2 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : HIGH (string)

integrityImpact : NONE (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (string)

version : 3.0 (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

description : OS Command Injection vulnerability (string)

lang : en (string)

type : text (string)

}

]

}

]

providerMetadata : { »

dateUpdated : 2018-06-14T09:57:01 (string)

orgId : 01626437-bf8f-4d1c-912a-893b5eb04808 (string)

shortName : trellix (string)

}

references : [ »

0 : { »

name : 103155 (string)

tags : [ »

0 : vdb-entry (string)

1 : x_refsource_BID (string)

]

url : http://www.securityfocus.com/bid/103155 (string)

}

1 : { »

tags : [ »

0 : x_refsource_CONFIRM (string)

]

url : https://kc.mcafee.com/corporate/index?page=content&id=SB10227 (string)

}

]

source : { »

advisory : SB10227 (string)

discovery : INTERNAL (string)

}

title : McAfee ePolicy Orchestrator (ePO) - OS Command Injection vulnerability (string)

x_legacyV4Record : { »

CVE_data_meta : { »

ASSIGNER : psirt@mcafee.com (string)

ID : CVE-2017-3936 (string)

STATE : PUBLIC (string)

TITLE : McAfee ePolicy Orchestrator (ePO) - OS Command Injection vulnerability (string)

}

affects : { »

vendor : { »

vendor_data : [ »

0 : { »

product : { »

product_data : [ »

0 : { »

product_name : ePolicy Orchestrator (ePO) (string)

version : { »

version_data : [ »

0 : { »

affected : < (string)

platform : x86 (string)

version_affected : < (string)

version_name : 5.1 (string)

version_value : 5.3.3 (string)

}

1 : { »

affected : < (string)

platform : x86 (string)

version_affected : < (string)

version_name : 5.3 (string)

version_value : 5.3.3 (string)

}

2 : { »

affected : < (string)

platform : x86 (string)

version_affected : < (string)

version_name : 5.9 (string)

version_value : 5.9.1 (string)

}

]

}

]

}

vendor_name : McAfee (string)

}

]

}

data_format : MITRE (string)

data_type : CVE (string)

data_version : 4.0 (string)

description : { »

description_data : [ »

0 : { »

lang : eng (string)

value : OS Command Injection vulnerability in McAfee ePolicy Orchestrator (ePO) 5.9.0, 5.3.2, 5.3.1, 5.1.3, 5.1.2, 5.1.1, and 5.1.0 allows attackers to run arbitrary OS commands with limited privileges via not sanitizing the user input data before exporting it into a CSV format output. (string)

}

]

}

impact : { »

cvss : { »

attackComplexity : LOW (string)

attackVector : LOCAL (string)

availabilityImpact : NONE (string)

baseScore : 6.2 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : HIGH (string)

integrityImpact : NONE (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (string)

version : 3.0 (string)

}

problemtype : { »

problemtype_data : [ »

0 : { »

description : [ »

0 : { »

lang : eng (string)

value : OS Command Injection vulnerability (string)

}

]

}

]

}

references : { »

reference_data : [ »

0 : { »

name : 103155 (string)

refsource : BID (string)

url : http://www.securityfocus.com/bid/103155 (string)

}

1 : { »

name : https://kc.mcafee.com/corporate/index?page=content&id=SB10227 (string)

refsource : CONFIRM (string)

url : https://kc.mcafee.com/corporate/index?page=content&id=SB10227 (string)

}

]

}

source : { »

advisory : SB10227 (string)

discovery : INTERNAL (string)

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-05T14:39:41.148Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

name : 103155 (string)

tags : [ »

0 : vdb-entry (string)

1 : x_refsource_BID (string)

2 : x_transferred (string)

]

url : http://www.securityfocus.com/bid/103155 (string)

}

1 : { »

tags : [ »

0 : x_refsource_CONFIRM (string)

1 : x_transferred (string)

]

url : https://kc.mcafee.com/corporate/index?page=content&id=SB10227 (string)

}

]

}

]

}

cveMetadata : { »

assignerOrgId : 01626437-bf8f-4d1c-912a-893b5eb04808 (string)

assignerShortName : trellix (string)

cveId : CVE-2017-3936 (string)

datePublished : 2018-06-13T21:00:00 (string)

dateReserved : 2016-12-26T00:00:00 (string)

dateUpdated : 2024-08-05T14:39:41.148Z (string)

state : PUBLISHED (string)

}

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "DE33AFB8-9962-4D75-B613-D5032A0949A1", "vulnerable": true}, {"criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.1.1:*:*:*:*:*:*:*", "matchCriteriaId": "CEBA52A8-233F-4015-B44B-1BF7B5593CCE", "vulnerable": true}, {"criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.1.2:*:*:*:*:*:*:*", "matchCriteriaId": "A0DBB72F-A984-4641-9230-97B815FCD31C", "vulnerable": true}, {"criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.1.3:*:*:*:*:*:*:*", "matchCriteriaId": "08F542C3-C2BB-420A-BCDB-AB5A688689B5", "vulnerable": true}, {"criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.3.1:*:*:*:*:*:*:*", "matchCriteriaId": "3D0E33E0-5B8F-4448-A5F3-5AE901AC8774", "vulnerable": true}, {"criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.3.2:*:*:*:*:*:*:*", "matchCriteriaId": "E9220E40-8664-4DB3-AF96-802F8CDEC58A", "vulnerable": true}, {"criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.9.0:*:*:*:*:*:*:*", "matchCriteriaId": "DEB90C24-D252-4099-A7A1-9F8754DFB4A5", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "OS Command Injection vulnerability in McAfee ePolicy Orchestrator (ePO) 5.9.0, 5.3.2, 5.3.1, 5.1.3, 5.1.2, 5.1.1, and 5.1.0 allows attackers to run arbitrary OS commands with limited privileges via not sanitizing the user input data before exporting it into a CSV format output."}, {"lang": "es", "value": "Vulnerabilidad de inyecci\u00f3n de comandos del sistema operativo en McAfee ePolicy Orchestrator (ePO) 5.9.0, 5.3.2, 5.3.1, 5.1.3, 5.1.2, 5.1.1 y 5.1.0 permite que los atacantes ejecuten comandos del sistema operativo con privilegios limitados al no sanear los datos de entrada del usuario antes de exportarlos a formato CSV."}], "id": "CVE-2017-3936", "lastModified": "2024-11-21T03:26:21.850", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 6.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.0"}, "exploitabilityScore": 2.5, "impactScore": 3.6, "source": "trellixpsirt@trellix.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2018-06-13T21:29:00.440", "references": [{"source": "trellixpsirt@trellix.com", "url": "http://www.securityfocus.com/bid/103155"}, {"source": "trellixpsirt@trellix.com", "url": "https://kc.mcafee.com/corporate/index?page=content&id=SB10227"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/103155"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://kc.mcafee.com/corporate/index?page=content&id=SB10227"}], "sourceIdentifier": "trellixpsirt@trellix.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:mcafee:epolicy_orchestrator:5.1.0:*:*:*:*:*:*:* (string)

matchCriteriaId : DE33AFB8-9962-4D75-B613-D5032A0949A1 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:mcafee:epolicy_orchestrator:5.1.1:*:*:*:*:*:*:* (string)

matchCriteriaId : CEBA52A8-233F-4015-B44B-1BF7B5593CCE (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:mcafee:epolicy_orchestrator:5.1.2:*:*:*:*:*:*:* (string)

matchCriteriaId : A0DBB72F-A984-4641-9230-97B815FCD31C (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:a:mcafee:epolicy_orchestrator:5.1.3:*:*:*:*:*:*:* (string)

matchCriteriaId : 08F542C3-C2BB-420A-BCDB-AB5A688689B5 (string)

vulnerable : true (boolean)

}

4 : { »

criteria : cpe:2.3:a:mcafee:epolicy_orchestrator:5.3.1:*:*:*:*:*:*:* (string)

matchCriteriaId : 3D0E33E0-5B8F-4448-A5F3-5AE901AC8774 (string)

vulnerable : true (boolean)

}

5 : { »

criteria : cpe:2.3:a:mcafee:epolicy_orchestrator:5.3.2:*:*:*:*:*:*:* (string)

matchCriteriaId : E9220E40-8664-4DB3-AF96-802F8CDEC58A (string)

vulnerable : true (boolean)

}

6 : { »

criteria : cpe:2.3:a:mcafee:epolicy_orchestrator:5.9.0:*:*:*:*:*:*:* (string)

matchCriteriaId : DEB90C24-D252-4099-A7A1-9F8754DFB4A5 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : OS Command Injection vulnerability in McAfee ePolicy Orchestrator (ePO) 5.9.0, 5.3.2, 5.3.1, 5.1.3, 5.1.2, 5.1.1, and 5.1.0 allows attackers to run arbitrary OS commands with limited privileges via not sanitizing the user input data before exporting it into a CSV format output. (string)

}

1 : { »

lang : es (string)

value : Vulnerabilidad de inyección de comandos del sistema operativo en McAfee ePolicy Orchestrator (ePO) 5.9.0, 5.3.2, 5.3.1, 5.1.3, 5.1.2, 5.1.1 y 5.1.0 permite que los atacantes ejecuten comandos del sistema operativo con privilegios limitados al no sanear los datos de entrada del usuario antes de exportarlos a formato CSV. (string)

}

]

id : CVE-2017-3936 (string)

lastModified : 2024-11-21T03:26:21.850 (string)

metrics : { »

cvssMetricV2 : [ »

0 : { »

acInsufInfo : false (boolean)

baseSeverity : HIGH (string)

cvssData : { »

accessComplexity : LOW (string)

accessVector : NETWORK (string)

authentication : NONE (string)

availabilityImpact : PARTIAL (string)

baseScore : 7.5 (number)

confidentialityImpact : PARTIAL (string)

integrityImpact : PARTIAL (string)

vectorString : AV:N/AC:L/Au:N/C:P/I:P/A:P (string)

version : 2.0 (string)

}

exploitabilityScore : 10 (number)

impactScore : 6.4 (number)

obtainAllPrivilege : false (boolean)

obtainOtherPrivilege : false (boolean)

obtainUserPrivilege : false (boolean)

source : nvd@nist.gov (string)

type : Primary (string)

userInteractionRequired : false (boolean)

}

]

cvssMetricV30 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : LOCAL (string)

availabilityImpact : NONE (string)

baseScore : 6.2 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : HIGH (string)

integrityImpact : NONE (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (string)

version : 3.0 (string)

}

exploitabilityScore : 2.5 (number)

impactScore : 3.6 (number)

source : trellixpsirt@trellix.com (string)

type : Secondary (string)

}

1 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : HIGH (string)

baseScore : 9.8 (number)

baseSeverity : CRITICAL (string)

confidentialityImpact : HIGH (string)

integrityImpact : HIGH (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (string)

version : 3.0 (string)

}

exploitabilityScore : 3.9 (number)

impactScore : 5.9 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

published : 2018-06-13T21:29:00.440 (string)

references : [ »

0 : { »

source : trellixpsirt@trellix.com (string)

url : http://www.securityfocus.com/bid/103155 (string)

}

1 : { »

source : trellixpsirt@trellix.com (string)

url : https://kc.mcafee.com/corporate/index?page=content&id=SB10227 (string)

}

2 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

url : http://www.securityfocus.com/bid/103155 (string)

}

3 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

url : https://kc.mcafee.com/corporate/index?page=content&id=SB10227 (string)

}

]

sourceIdentifier : trellixpsirt@trellix.com (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-78 (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

Affected Vendors & Products

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object