CVE-2019-2999

CVE-2019-2999 is a difficult-to-exploit vulnerability in the Javadoc component of Oracle Java SE versions 7u231, 8u221, 11.0.4, and 13, primarily affecting client-side Java deployments running untrusted code. An unauthenticated attacker can compromise Java SE through network access via multiple protocols, requiring human interaction from a non-attacker. Successful exploitation can lead to unauthorized update, insert, delete, or read access to a subset of Java SE accessible data, potentially impacting additional products. Rated with a CVSS 3.0 Base Score of 4.7 (Medium), this vulnerability has a network attack vector, high attack complexity, and requires user interaction. The impact is limited to partial confidentiality and integrity. This vulnerability does not apply to server-side Java deployments running only trusted code. There is no evidence of active exploitation, publicly available exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE. It is not listed on the CISA KEV catalog and is considered inactive on the Hot List.