CVE-2022-21449

high-risk
Published 2022-04-19

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 17.0.2 and 18; Oracle GraalVM Enterprise Edition: 21.3.1 and 22.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).

Do I need to act?

!
34.3% chance of exploitation in next 30 days
EPSS score — higher than 66% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.5/10 High
NETWORK / LOW complexity

Affected Products (20)

Jdk
Jdk

Affected Vendors

Debian Oracle Netapp Azul

References (36)

Mailing List http://www.openwall.com/lists/oss-security/2022/04/28/2
Mailing List http://www.openwall.com/lists/oss-security/2022/04/28/3
Mailing List http://www.openwall.com/lists/oss-security/2022/04/28/4
Mailing List http://www.openwall.com/lists/oss-security/2022/04/28/5
Mailing List http://www.openwall.com/lists/oss-security/2022/04/28/6
Mailing List http://www.openwall.com/lists/oss-security/2022/04/28/7
Mailing List http://www.openwall.com/lists/oss-security/2022/04/29/1
Mailing List http://www.openwall.com/lists/oss-security/2022/04/30/1
Mailing List http://www.openwall.com/lists/oss-security/2022/04/30/2
Mailing List http://www.openwall.com/lists/oss-security/2022/04/30/3
Mailing List http://www.openwall.com/lists/oss-security/2022/04/30/4
Mailing List http://www.openwall.com/lists/oss-security/2022/05/01/1
Mailing List http://www.openwall.com/lists/oss-security/2022/05/01/2
Mailing List http://www.openwall.com/lists/oss-security/2022/05/02/1
Third Party Advisory https://security.netapp.com/advisory/ntap-20220429-0006/
Third Party Advisory https://www.debian.org/security/2022/dsa-5128
Third Party Advisory https://www.debian.org/security/2022/dsa-5131
Patch https://www.oracle.com/security-alerts/cpuapr2022.html
Mailing List http://www.openwall.com/lists/oss-security/2022/04/28/2
Mailing List http://www.openwall.com/lists/oss-security/2022/04/28/3
and 16 more references
62
/ 100
high-risk
Severity 26/34 · High
Exploitability 16/34 · Moderate
Exposure 20/34 · Moderate