Lucene search

OracleCVE-2022-21449

HistoryApr 19, 2022 - 9:15 p.m.

CVE-2022-21449

2022-04-1921:15:16

oracle

web.nvd.nist.gov

1100

cve-2022-21449

oracle

java se

graalvm

enterprise edition

vulnerability

unauthorized access

data

compromise

integrity

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

AI Score

6.9

Confidence

High

EPSS

0.001

Percentile

39.3%

JSON

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 17.0.2 and 18; Oracle GraalVM Enterprise Edition: 21.3.1 and 22.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).

Affected configurations

Nvd

Vulners

Node

oraclegraalvmMatch21.3.1enterprise

oraclegraalvmMatch22.0.0.2enterprise

oraclejdkMatch17.0.2

oraclejdkMatch18

Node

debiandebian_linuxMatch10.0

debiandebian_linuxMatch11.0

Node

netapp7-mode_transition_toolMatch-

netappactive_iq_unified_managerMatch-vsphere

netappactive_iq_unified_managerMatch-windows

netappcloud_insightsMatch-

netappe-series_santricity_os_controllerMatch11.0

netappe-series_santricity_storage_managerMatch-

netappe-series_santricity_web_servicesMatch-

netapponcommand_insightMatch-

netapponcommand_workflow_automationMatch-

netappsantricity_unified_managerMatch-

netappsolidfire\,_enterprise_sds_\&_hci_storage_nodeMatch-

netappsolidfire_\&_hci_management_nodeMatch-

netapphci_compute_nodeMatch-

Node

azulzuluMatch15.38

azulzuluMatch17.32

azulzuluMatch18.28

VendorProductVersionCPE
oraclegraalvm21.3.1cpe:2.3:a:oracle:graalvm:21.3.1:*:*:*:enterprise:*:*:*
oraclegraalvm22.0.0.2cpe:2.3:a:oracle:graalvm:22.0.0.2:*:*:*:enterprise:*:*:*
oraclejdk17.0.2cpe:2.3:a:oracle:jdk:17.0.2:*:*:*:*:*:*:*
oraclejdk18cpe:2.3:a:oracle:jdk:18:*:*:*:*:*:*:*
debiandebian_linux10.0cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
debiandebian_linux11.0cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
netapp7-mode_transition_tool-cpe:2.3:a:netapp:7-mode_transition_tool:-:*:*:*:*:*:*:*
netappactive_iq_unified_manager-cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vsphere:*:*
netappactive_iq_unified_manager-cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*
netappcloud_insights-cpe:2.3:a:netapp:cloud_insights:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
oracle	graalvm	21.3.1	cpe:2.3:a:oracle:graalvm:21.3.1::::enterprise:::
oracle	graalvm	22.0.0.2	cpe:2.3:a:oracle:graalvm:22.0.0.2::::enterprise:::
oracle	jdk	17.0.2	cpe:2.3:a:oracle:jdk:17.0.2:::::::*
oracle	jdk	18	cpe:2.3:a:oracle:jdk:18:::::::*
debian	debian_linux	10.0	cpe:2.3:o:debian:debian_linux:10.0:::::::*
debian	debian_linux	11.0	cpe:2.3:o:debian:debian_linux:11.0:::::::*
netapp	7-mode_transition_tool	-	cpe:2.3:a:netapp:7-mode_transition_tool:-:::::::*
netapp	active_iq_unified_manager	-	cpe:2.3:a:netapp:active_iq_unified_manager:-:::::vsphere::
netapp	active_iq_unified_manager	-	cpe:2.3:a:netapp:active_iq_unified_manager:-:::::windows::
netapp	cloud_insights	-	cpe:2.3:a:netapp:cloud_insights:-:::::::*

Rows per page:

1-10 of 221

CNA Affected

[
  {
    "product": "Java SE JDK and JRE",
    "vendor": "Oracle Corporation",
    "versions": [
      {
        "status": "affected",
        "version": "Oracle Java SE:17.0.2"
      },
      {
        "status": "affected",
        "version": "Oracle Java SE:18"
      },
      {
        "status": "affected",
        "version": "Oracle GraalVM Enterprise Edition:21.3.1"
      },
      {
        "status": "affected",
        "version": "Oracle GraalVM Enterprise Edition:22.0.0.2"
      }
    ]
  }
]