CVE-2022-21624 is a low-severity vulnerability affecting Oracle Java SE and Oracle GraalVM Enterprise Edition, specifically within the JNDI component. An unauthenticated attacker with network access can exploit this with high attack complexity to achieve unauthorized data modification (integrity impact). While it primarily impacts Java deployments running untrusted code in a sandbox, it can also be exploited via APIs. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
20.3.7CPE matchmatch criteria | cpe:2.3:a:oracle:graalvm:20.3.7:*:*:*:enterprise:*:*:* | ||
21.3.3CPE matchmatch criteria | cpe:2.3:a:oracle:graalvm:21.3.3:*:*:*:enterprise:*:*:* | ||
22.2.0CPE matchmatch criteria | cpe:2.3:a:oracle:graalvm:22.2.0:*:*:*:enterprise:*:*:* | ||
1.8.0CPE matchmatch criteria | cpe:2.3:a:oracle:jdk:1.8.0:update341:*:*:*:*:*:* | ||
1.8.0CPE matchmatch criteria | cpe:2.3:a:oracle:jdk:1.8.0:update345:*:*:enterprise_performance_pack:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.3 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
OpenJDK: insufficient randomization of JNDI DNS port numbers (JNDI, 8286910)
Oct 18, 2022Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JNDI). Supported versions that are affected are Oracle Java SE: 8u341, 8u345-perf, 11.0.16.1, 17.0.4.1, 19; Oracle GraalVM Enterprise Edition: 20.3.7, 21.3.3 and 22.2.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web
Oct 11, 2022