CVE-2022-21619 is a low-severity vulnerability affecting Oracle Java SE and Oracle GraalVM Enterprise Edition, specifically within the Security component. It allows an unauthenticated attacker with network access to achieve unauthorized data modification (update, insert, or delete) on some accessible data. While difficult to exploit, it primarily impacts Java deployments running sandboxed applications that load untrusted code, or via APIs supplying data to the affected component. There is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
20.3.7CPE matchmatch criteria | cpe:2.3:a:oracle:graalvm:20.3.7:*:*:*:enterprise:*:*:* | ||
21.3.3CPE matchmatch criteria | cpe:2.3:a:oracle:graalvm:21.3.3:*:*:*:enterprise:*:*:* | ||
22.2.0CPE matchmatch criteria | cpe:2.3:a:oracle:graalvm:22.2.0:*:*:*:enterprise:*:*:* | ||
1.8.0CPE matchmatch criteria | cpe:2.3:a:oracle:jdk:1.8.0:update341:*:*:*:*:*:* | ||
1.8.0CPE matchmatch criteria | cpe:2.3:a:oracle:jdk:1.8.0:update345:*:*:enterprise_performance_pack:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.3 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
OpenJDK: improper handling of long NTLM client hostnames (Security, 8286526)
Oct 18, 2022Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u341, 8u345-perf, 11.0.16.1, 17.0.4.1, 19; Oracle GraalVM Enterprise Edition: 20.3.7, 21.3.3 and 22.2.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a
Oct 11, 2022