CVE-2022-21597

2022-10-1800:00:00

oracle

www.cve.org

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.9 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

33.2%

JSON

Vulnerability in the Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JavaScript). Supported versions that are affected are Oracle GraalVM Enterprise Edition: 20.3.7, 21.3.3 and 22.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle GraalVM Enterprise Edition accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

CNA Affected

[
  {
    "vendor": "Oracle Corporation",
    "product": "GraalVM Enterprise Edition",
    "versions": [
      {
        "version": "Oracle GraalVM Enterprise Edition:20.3.7",
        "status": "affected"
      },
      {
        "version": "Oracle GraalVM Enterprise Edition:21.3.3",
        "status": "affected"
      },
      {
        "version": "Oracle GraalVM Enterprise Edition:22.2.0",
        "status": "affected"
      }
    ]
  }
]