CVE-2022-21541 is a difficult-to-exploit vulnerability in Oracle Java SE (versions 7u343, 8u333, 11.0.15.1, 17.0.3.1, 18.0.1.1) and Oracle GraalVM Enterprise Edition (versions 20.3.6, 21.3.2, 22.1.0), specifically affecting the Hotspot component. This vulnerability allows an unauthenticated attacker with network access to compromise affected systems, primarily impacting the integrity of data by enabling unauthorized creation, deletion, or modification. With a CVSS v3.1 score of 5.9 (Medium), it requires high attack complexity and affects data integrity without impacting confidentiality or availability. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
20.3.6CPE matchmatch criteria | cpe:2.3:a:oracle:graalvm:20.3.6:*:*:*:enterprise:*:*:* | ||
21.3.2CPE matchmatch criteria | cpe:2.3:a:oracle:graalvm:21.3.2:*:*:*:enterprise:*:*:* | ||
22.1.0CPE matchmatch criteria | cpe:2.3:a:oracle:graalvm:22.1.0:*:*:*:enterprise:*:*:* | ||
1.7.0CPE matchmatch criteria | cpe:2.3:a:oracle:jdk:1.7.0:update343:*:*:*:*:*:* | ||
1.8.0CPE matchmatch criteria | cpe:2.3:a:oracle:jdk:1.8.0:update333:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
OpenJDK: improper restriction of MethodHandle.invokeBasic() (Hotspot, 8281866)
Jul 19, 2022Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 7u343, 8u333, 11.0.15.1, 17.0.3.1, 18.0.1.1; Oracle GraalVM Enterprise Edition: 20.3.6, 21.3.2 and 22.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Com
Jul 12, 2022