Lucene search

OracleCVE-2022-21296

HistoryJan 19, 2022 - 12:15 p.m.

CVE-2022-21296

2022-01-1912:15:12

oracle

web.nvd.nist.gov

224

cve-2022-21296

oracle

java se

graalvm

vulnerability

unauthorized access

data breach

security issue

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

4.5

Confidence

High

EPSS

0.003

Percentile

70.5%

JSON

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

Affected configurations

Nvd

Vulners

Node

oraclegraalvmMatch20.3.4enterprise

oraclegraalvmMatch21.3.0enterprise

oraclejdkMatch1.7.0update321

oraclejdkMatch1.8.0update311

oraclejdkMatch11.0.13

oraclejdkMatch17.0.1

oraclejreMatch1.7.0update321

oraclejreMatch1.8.0update311

oraclejreMatch11.0.13

oraclejreMatch17.0.1

Node

netapp7-mode_transition_toolMatch-

netappactive_iq_unified_managerMatch-vmware_vsphere

netappactive_iq_unified_managerMatch-windows

netappcloud_insights_acquisition_unitMatch-

netappcloud_secure_agentMatch-

netappe-series_santricity_os_controllerRange11.0.0–11.70.1

netappe-series_santricity_storage_managerMatch-

netappe-series_santricity_web_servicesMatch-web_services_proxy

netapphci_management_nodeMatch-

netapponcommand_insightMatch-

netapponcommand_workflow_automationMatch-

netappsantricity_storage_pluginMatch-vcenter

netappsantricity_unified_managerMatch-

netappsnapmanagerMatch-oracle

netappsnapmanagerMatch-sap

netappsolidfireMatch-

Node

debiandebian_linuxMatch9.0

debiandebian_linuxMatch10.0

debiandebian_linuxMatch11.0

Node

oracleopenjdkRange11–11.0.13

oracleopenjdkRange13–13.0.9

oracleopenjdkRange15–15.0.5

oracleopenjdkMatch7-

oracleopenjdkMatch7update1

oracleopenjdkMatch7update10

oracleopenjdkMatch7update101

oracleopenjdkMatch7update11

oracleopenjdkMatch7update111

oracleopenjdkMatch7update121

oracleopenjdkMatch7update13

oracleopenjdkMatch7update131

oracleopenjdkMatch7update141

oracleopenjdkMatch7update15

oracleopenjdkMatch7update151

oracleopenjdkMatch7update161

oracleopenjdkMatch7update17

oracleopenjdkMatch7update171

oracleopenjdkMatch7update181

oracleopenjdkMatch7update191

oracleopenjdkMatch7update2

oracleopenjdkMatch7update201

oracleopenjdkMatch7update21

oracleopenjdkMatch7update211

oracleopenjdkMatch7update221

oracleopenjdkMatch7update231

oracleopenjdkMatch7update241

oracleopenjdkMatch7update25

oracleopenjdkMatch7update251

oracleopenjdkMatch7update261

oracleopenjdkMatch7update271

oracleopenjdkMatch7update281

oracleopenjdkMatch7update291

oracleopenjdkMatch7update3

oracleopenjdkMatch7update301

oracleopenjdkMatch7update311

oracleopenjdkMatch7update321

oracleopenjdkMatch7update4

oracleopenjdkMatch7update40

oracleopenjdkMatch7update45

oracleopenjdkMatch7update5

oracleopenjdkMatch7update51

oracleopenjdkMatch7update55

oracleopenjdkMatch7update6

oracleopenjdkMatch7update60

oracleopenjdkMatch7update65

oracleopenjdkMatch7update67

oracleopenjdkMatch7update7

oracleopenjdkMatch7update72

oracleopenjdkMatch7update76

oracleopenjdkMatch7update80

oracleopenjdkMatch7update85

oracleopenjdkMatch7update9

oracleopenjdkMatch7update91

oracleopenjdkMatch7update95

oracleopenjdkMatch7update97

oracleopenjdkMatch7update99

oracleopenjdkMatch8-

oracleopenjdkMatch8milestone1

oracleopenjdkMatch8milestone2

oracleopenjdkMatch8milestone3

oracleopenjdkMatch8milestone4

oracleopenjdkMatch8milestone5

oracleopenjdkMatch8milestone6

oracleopenjdkMatch8milestone7

oracleopenjdkMatch8milestone8

oracleopenjdkMatch8milestone9

oracleopenjdkMatch8update101

oracleopenjdkMatch8update102

oracleopenjdkMatch8update11

oracleopenjdkMatch8update111

oracleopenjdkMatch8update112

oracleopenjdkMatch8update121

oracleopenjdkMatch8update131

oracleopenjdkMatch8update141

oracleopenjdkMatch8update151

oracleopenjdkMatch8update152

oracleopenjdkMatch8update161

oracleopenjdkMatch8update162

oracleopenjdkMatch8update171

oracleopenjdkMatch8update172

oracleopenjdkMatch8update181

oracleopenjdkMatch8update191

oracleopenjdkMatch8update192

oracleopenjdkMatch8update20

oracleopenjdkMatch8update201

oracleopenjdkMatch8update202

oracleopenjdkMatch8update211

oracleopenjdkMatch8update212

oracleopenjdkMatch8update221

oracleopenjdkMatch8update222

oracleopenjdkMatch8update231

oracleopenjdkMatch8update232

oracleopenjdkMatch8update241

oracleopenjdkMatch8update242

oracleopenjdkMatch8update25

oracleopenjdkMatch8update252

oracleopenjdkMatch8update262

oracleopenjdkMatch8update271

oracleopenjdkMatch8update281

oracleopenjdkMatch8update282

oracleopenjdkMatch8update291

oracleopenjdkMatch8update301

oracleopenjdkMatch8update302

oracleopenjdkMatch8update31

oracleopenjdkMatch8update312

oracleopenjdkMatch8update40

oracleopenjdkMatch8update45

oracleopenjdkMatch8update5

oracleopenjdkMatch8update51

oracleopenjdkMatch8update60

oracleopenjdkMatch8update65

oracleopenjdkMatch8update66

oracleopenjdkMatch8update71

oracleopenjdkMatch8update72

oracleopenjdkMatch8update73

oracleopenjdkMatch8update74

oracleopenjdkMatch8update77

oracleopenjdkMatch8update91

oracleopenjdkMatch8update92

oracleopenjdkMatch17

oracleopenjdkMatch17.0.1

VendorProductVersionCPE
oraclejava_se*cpe:2.3:a:oracle:java_se:*:*:*:*:*:*:*:*
oraclejava_se*cpe:2.3:a:oracle:java_se:*:*:*:*:*:*:*:*
oraclejava_se*cpe:2.3:a:oracle:java_se:*:*:*:*:*:*:*:*
oraclejava_se*cpe:2.3:a:oracle:java_se:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
oracle	java_se	*	cpe:2.3:a:oracle:java_se::::::::
oracle	java_se	*	cpe:2.3:a:oracle:java_se::::::::
oracle	java_se	*	cpe:2.3:a:oracle:java_se::::::::
oracle	java_se	*	cpe:2.3:a:oracle:java_se::::::::

CNA Affected

[
  {
    "product": "Java SE JDK and JRE",
    "vendor": "Oracle Corporation",
    "versions": [
      {
        "status": "affected",
        "version": "Oracle Java SE:7u321"
      },
      {
        "status": "affected",
        "version": "Oracle Java SE:8u311"
      },
      {
        "status": "affected",
        "version": "Oracle Java SE:11.0.13"
      },
      {
        "status": "affected",
        "version": "Oracle Java SE:17.0.1"
      },
      {
        "status": "affected",
        "version": "Oracle GraalVM Enterprise Edition:20.3.4"
      },
      {
        "status": "affected",
        "version": "Oracle GraalVM Enterprise Edition:21.3.0"
      }
    ]
  }
]