3.7

CVE-2022-21619

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u341, 8u345-perf, 11.0.16.1, 17.0.4.1, 19; Oracle GraalVM Enterprise Edition: 20.3.7, 21.3.3 and 22.2.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Oracle ≫ Graalvm Version 20.3.7 SwEdition enterprise
Oracle ≫ Graalvm Version 21.3.3 SwEdition enterprise
Oracle ≫ Graalvm Version 22.2.0 SwEdition enterprise
Oracle ≫ Jdk Version 1.8.0 Update update341
Oracle ≫ Jdk Version 1.8.0 Update update345 SwEdition enterprise_performance_pack
Oracle ≫ Jdk Version 11.0.16.1
Oracle ≫ Jdk Version 17.0.4.1
Oracle ≫ Jdk Version 19
Oracle ≫ Jre Version 1.8.0 Update update341
Oracle ≫ Jre Version 1.8.0 Update update345 SwEdition enterprise_performance_pack
Oracle ≫ Jre Version 11.0.16.1
Oracle ≫ Jre Version 17.0.4.1
Oracle ≫ Jre Version 19
Fedoraproject ≫ Fedora Version 35
Fedoraproject ≫ Fedora Version 36
Netapp ≫ Cloud Secure Agent Version -
Netapp ≫ E-series Santricity Os Controller Version >= 11.0 < 11.70.2
Netapp ≫ Oncommand Insight Version -
Netapp ≫ Santricity Storage Plugin Version - SwPlatform vcenter
Azul ≫ Zulu Version 7.56
Azul ≫ Zulu Version 8.64
Azul ≫ Zulu Version 11.58
Azul ≫ Zulu Version 13.50
Azul ≫ Zulu Version 15.42
Azul ≫ Zulu Version 17.36
Azul ≫ Zulu Version 19.28
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.61% 0.841
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
Oracle 3.7 2.2 1.4
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
CWE-284 Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

https://security.gentoo.org/glsa/202401-25
https://www.oracle.com/security-alerts/cpuoct2022.html
Patch
Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/37QDWJBGEPP65X43NXQTXQ7KASLUHON6/
Third Party Advisory
Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3ARF4QF4N3X5GSFHXUBWARGLISGKJ33R/
Third Party Advisory
Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3QLQ7OD33W6LT3HWI7VYDFFJLV75Y73K/
Third Party Advisory
Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EXSBV3W6EP6B7XJ63Z2FPVBH6HAPGJ5T/
Third Party Advisory
Mailing List
https://security.netapp.com/advisory/ntap-20221028-0012/
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HNGMDNIHAA73BEX6XPA2IMXJSGOKKYE6/
Third Party Advisory
Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PB3CIGOFG7CENUVVE4FFZT2HI5FO77XU/
Third Party Advisory
Mailing List