Lucene search

K
cveOracleCVE-2022-21443
HistoryApr 19, 2022 - 9:15 p.m.

CVE-2022-21443

2022-04-1921:15:15
oracle
web.nvd.nist.gov
258
3
oracle
java se
graalvm
cve
vulnerability
security
exploit
denial of service
nvd
network access
cvss

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

CVSS3

3.7

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

AI Score

4.5

Confidence

High

EPSS

0.003

Percentile

70.1%

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 7u331, 8u321, 11.0.14, 17.0.2, 18; Oracle GraalVM Enterprise Edition: 20.3.5, 21.3.1 and 22.0.0.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).

Affected configurations

Nvd
Vulners
Node
oraclegraalvmMatch20.3.5enterprise
OR
oraclegraalvmMatch21.3.1enterprise
OR
oraclegraalvmMatch22.0.0.2enterprise
OR
oraclejava_seMatch7u331
OR
oraclejava_seMatch8u321
OR
oraclejava_seMatch11.0.14
OR
oraclejava_seMatch17.0.2
OR
oraclejava_seMatch18
Node
netappactive_iq_unified_managerMatch-vmware_vsphere
OR
netappactive_iq_unified_managerMatch-windows
OR
netappcloud_insights_acquisition_unitMatch-
OR
netappcloud_secure_agentMatch-
OR
netappe-series_santricity_os_controllerRange11.0.011.70.1
OR
netappe-series_santricity_storage_managerMatch-
OR
netappe-series_santricity_web_servicesMatch-web_services_proxy
OR
netappelement_softwareMatch-
OR
netapphci_management_nodeMatch-
OR
netapponcommand_insightMatch-
OR
netappsantricity_unified_managerMatch-
OR
netappsolidfireMatch-
Node
netappbootstrap_osMatch-
AND
netapphci_compute_nodeMatch-
Node
debiandebian_linuxMatch9.0
OR
debiandebian_linuxMatch10.0
OR
debiandebian_linuxMatch11.0
Node
azulzuluMatch6.45
OR
azulzuluMatch7.52
OR
azulzuluMatch8.60
OR
azulzuluMatch11.54
OR
azulzuluMatch13.46
OR
azulzuluMatch15.38
OR
azulzuluMatch17.32
OR
azulzuluMatch18.28
VendorProductVersionCPE
oraclegraalvm20.3.5cpe:2.3:a:oracle:graalvm:20.3.5:*:*:*:enterprise:*:*:*
oraclegraalvm21.3.1cpe:2.3:a:oracle:graalvm:21.3.1:*:*:*:enterprise:*:*:*
oraclegraalvm22.0.0.2cpe:2.3:a:oracle:graalvm:22.0.0.2:*:*:*:enterprise:*:*:*
oraclejava_se7u331cpe:2.3:a:oracle:java_se:7u331:*:*:*:*:*:*:*
oraclejava_se8u321cpe:2.3:a:oracle:java_se:8u321:*:*:*:*:*:*:*
oraclejava_se11.0.14cpe:2.3:a:oracle:java_se:11.0.14:*:*:*:*:*:*:*
oraclejava_se17.0.2cpe:2.3:a:oracle:java_se:17.0.2:*:*:*:*:*:*:*
oraclejava_se18cpe:2.3:a:oracle:java_se:18:*:*:*:*:*:*:*
netappactive_iq_unified_manager-cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
netappactive_iq_unified_manager-cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*
Rows per page:
1-10 of 331

CNA Affected

[
  {
    "vendor": "Oracle Corporation",
    "product": "Java SE JDK and JRE",
    "versions": [
      {
        "version": "Oracle Java SE:7u331",
        "status": "affected"
      },
      {
        "version": "Oracle Java SE:8u321",
        "status": "affected"
      },
      {
        "version": "Oracle Java SE:11.0.14",
        "status": "affected"
      },
      {
        "version": "Oracle Java SE:17.0.2",
        "status": "affected"
      },
      {
        "version": "Oracle Java SE:18",
        "status": "affected"
      },
      {
        "version": "Oracle GraalVM Enterprise Edition:20.3.5",
        "status": "affected"
      },
      {
        "version": "Oracle GraalVM Enterprise Edition:21.3.1",
        "status": "affected"
      },
      {
        "version": "Oracle GraalVM Enterprise Edition:22.0.0.2",
        "status": "affected"
      }
    ]
  }
]

Social References

More

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

CVSS3

3.7

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

AI Score

4.5

Confidence

High

EPSS

0.003

Percentile

70.1%