CVE-2022-21449

Common vulnerabilities & exposures (CVE)

CVE database CVE database blogpost Release & EoL database

Published at: - 19-04-2022 11:15

Last modified: - 13-05-2022 02:55

Total changes: - 11

Description

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 17.0.2 and 18; Oracle GraalVM Enterprise Edition: 21.3.1 and 22.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Low

Attack complexity

Network

Attack vector

None

Availability

None

Confidentiality

High

Integrity

None

Privileges required

Unchanged

Scope

None

User interaction

7.5

Base score

3.9

3.6

Exploitability score

Impact score

Verification logic

vendor=oracle AND product=graalvm AND version=21.3.1 AND software_edition=enterprise

vendor=oracle AND product=graalvm AND version=22.0.0.2 AND software_edition=enterprise

vendor=oracle AND product=jdk AND version=18

vendor=oracle AND product=jdk AND version=17.0.2

vendor=Debian AND product=debian_linux AND version=10.0

vendor=Debian AND product=debian_linux AND version=11.0

vendor=netapp AND product=oncommand_workflow_automation AND version=-

vendor=netapp AND product=oncommand_insight AND version=-

vendor=netapp AND product=cloud_insights AND version=-

vendor=netapp AND product=e-series_santricity_storage_manager AND version=-

vendor=netapp AND product=e-series_santricity_web_services AND version=-

vendor=netapp AND product=solidfire_\&_hci_management_node AND version=-

vendor=netapp AND product=santricity_unified_manager AND version=-

vendor=netapp AND product=hci_compute_node AND version=-

vendor=netapp AND product=7-mode_transition_tool AND version=-

vendor=netapp AND product=active_iq_unified_manager AND version=- AND target_software=windows

vendor=netapp AND product=active_iq_unified_manager AND version=- AND target_software=vsphere

vendor=netapp AND product=e-series_santricity_os_controller AND version=11.0

vendor=netapp AND product=solidfire\,_enterprise_sds_\&_hci_storage_node AND version=-

Reference

https://www.oracle.com/security-alerts/cpuapr2022.html
[oss-security] 20220428 CVE-2022-21449 and version reporting-Mailing List, Third Party Advisory
[oss-security] 20220428 Re: CVE-2022-21449 and version reporting-Mailing List
[oss-security] 20220428 Re: CVE-2022-21449 and version reporting-Mailing List, Third Party Advisory
[oss-security] 20220428 Re: CVE-2022-21449 and version reporting-Mailing List, Third Party Advisory
[oss-security] 20220428 Re: CVE-2022-21449 and version reporting-Mailing List, Third Party Advisory
[oss-security] 20220428 Re: CVE-2022-21449 and version reporting-Mailing List, Third Party Advisory
https://security.netapp.com/advisory/ntap-20220429-0006/
[oss-security] 20220429 Re: CVE-2022-21449 and version reporting-Mailing List, Third Party Advisory
[oss-security] 20220430 Re: CVE-2022-21449 and version reporting-Mailing List, Third Party Advisory
[oss-security] 20220430 Re: CVE-2022-21449 and version reporting-Mailing List, Third Party Advisory
[oss-security] 20220430 Re: CVE-2022-21449 and version reporting-Mailing List, Third Party Advisory
[oss-security] 20220430 Re: CVE-2022-21449 and version reporting-Mailing List, Third Party Advisory
[oss-security] 20220430 Re: CVE-2022-21449 and version reporting-Mailing List, Third Party Advisory
[oss-security] 20220501 Re: CVE-2022-21449 and version reporting-Mailing List, Third Party Advisory
[oss-security] 20220502 Re: CVE-2022-21449 and version reporting-Mailing List, Third Party Advisory
DSA-5128-Third Party Advisory
DSA-5131-Third Party Advisory

Keywords

CVE-2022-21449

Common vulnerabilities & exposures (CVE)

Description

Common Vulnerability Scoring System (CVSS)

Verification logic

Reference

NVD

CVE-2022-21449

CVE

Common vulnerabilities & exposures

CVSS

Common vulnerability scoring system

Security

Vulnerabilities

Exposures