CVE-2022-21305 is a vulnerability in Oracle Java SE (versions 7u321, 8u311, 11.0.13, 17.0.1) and Oracle GraalVM Enterprise Edition (versions 20.3.4, 21.3.0), specifically affecting the Hotspot component. This easily exploitable flaw allows unauthenticated attackers with network access to compromise affected systems. Successful exploitation can lead to unauthorized modification or deletion of accessible data, primarily impacting Java deployments running untrusted code within a sandbox or through APIs. With a CVSS 3.1 Base Score of 5.3 (Medium), the vulnerability has a low integrity impact and requires no user interaction. The attack vector is network-based with low attack complexity. Currently, there is no evidence of active exploitation, and no public exploit code is available in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
20.3.4CPE matchmatch criteria | cpe:2.3:a:oracle:graalvm:20.3.4:*:*:*:enterprise:*:*:* | ||
21.3.0CPE matchmatch criteria | cpe:2.3:a:oracle:graalvm:21.3.0:*:*:*:enterprise:*:*:* | ||
1.7.0CPE matchmatch criteria | cpe:2.3:a:oracle:jdk:1.7.0:update321:*:*:*:*:*:* | ||
1.8.0CPE matchmatch criteria | cpe:2.3:a:oracle:jdk:1.8.0:update311:*:*:*:*:*:* | ||
11.0.13CPE matchmatch criteria | cpe:2.3:a:oracle:jdk:11.0.13:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
OpenJDK: Array indexing issues in LIRGenerator (Hotspot, 8272014)
Jan 18, 2022Vulnerability in the Oracle Java SE Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 7u321 8u311 11.0.13 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update insert or delete access to some of Oracle Java SE Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments typically in clients running sandboxed Java Web Start applications or sandboxed Java applets that load and run untrusted code (e.g. code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component e.g. through a web service which supplies data to
Jan 11, 2022