Lucene search

OracleCVE-2023-22025

HistoryOct 17, 2023 - 10:15 p.m.

CVE-2023-22025

2023-10-1722:15:11

oracle

web.nvd.nist.gov

351

cve-2023-22025

oracle

java

oracle java se

graalvm

jdk

security vulnerability

network access

unauthorized access

data compromise

integrity impact

cve-3.1 base score

CVSS3

3.7

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

AI Score

3.5

Confidence

High

EPSS

0.001

Percentile

31.4%

JSON

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u381-perf, 17.0.8, 21; Oracle GraalVM for JDK: 17.0.8, 21; Oracle GraalVM Enterprise Edition: 21.3.7 and 22.3.3. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition,. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).

Affected configurations

Nvd

Vulners

Node

oraclegraalvm_for_jdkMatch17.0.8

oraclegraalvm_for_jdkMatch21

oraclejdkMatch1.8.0update381enterprise_performance_pack

oraclejdkMatch17.0.8

oraclejdkMatch21.0.0

oraclejreMatch1.8.0update381enterprise_performance_pack

oraclejreMatch17.0.8

oraclejreMatch21.0.0

Node

netappcloud_insights_acquisition_unitMatch-

netappcloud_insights_storage_workload_security_agentMatch-

VendorProductVersionCPE
oraclegraalvm_for_jdk17.0.8cpe:2.3:a:oracle:graalvm_for_jdk:17.0.8:*:*:*:*:*:*:*
oraclegraalvm_for_jdk21cpe:2.3:a:oracle:graalvm_for_jdk:21:*:*:*:*:*:*:*
oraclejdk1.8.0cpe:2.3:a:oracle:jdk:1.8.0:update381:*:*:enterprise_performance_pack:*:*:*
oraclejdk17.0.8cpe:2.3:a:oracle:jdk:17.0.8:*:*:*:*:*:*:*
oraclejdk21.0.0cpe:2.3:a:oracle:jdk:21.0.0:*:*:*:*:*:*:*
oraclejre1.8.0cpe:2.3:a:oracle:jre:1.8.0:update381:*:*:enterprise_performance_pack:*:*:*
oraclejre17.0.8cpe:2.3:a:oracle:jre:17.0.8:*:*:*:*:*:*:*
oraclejre21.0.0cpe:2.3:a:oracle:jre:21.0.0:*:*:*:*:*:*:*
netappcloud_insights_acquisition_unit-cpe:2.3:a:netapp:cloud_insights_acquisition_unit:-:*:*:*:*:*:*:*
netappcloud_insights_storage_workload_security_agent-cpe:2.3:a:netapp:cloud_insights_storage_workload_security_agent:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
oracle	graalvm_for_jdk	17.0.8	cpe:2.3:a:oracle:graalvm_for_jdk:17.0.8:::::::*
oracle	graalvm_for_jdk	21	cpe:2.3:a:oracle:graalvm_for_jdk:21:::::::*
oracle	jdk	1.8.0	cpe:2.3:a:oracle:jdk:1.8.0:update381:::enterprise_performance_pack:::*
oracle	jdk	17.0.8	cpe:2.3:a:oracle:jdk:17.0.8:::::::*
oracle	jdk	21.0.0	cpe:2.3:a:oracle:jdk:21.0.0:::::::*
oracle	jre	1.8.0	cpe:2.3:a:oracle:jre:1.8.0:update381:::enterprise_performance_pack:::*
oracle	jre	17.0.8	cpe:2.3:a:oracle:jre:17.0.8:::::::*
oracle	jre	21.0.0	cpe:2.3:a:oracle:jre:21.0.0:::::::*
netapp	cloud_insights_acquisition_unit	-	cpe:2.3:a:netapp:cloud_insights_acquisition_unit:-:::::::*
netapp	cloud_insights_storage_workload_security_agent	-	cpe:2.3:a:netapp:cloud_insights_storage_workload_security_agent:-:::::::*

CNA Affected

[
  {
    "vendor": "Oracle Corporation",
    "product": "Java SE JDK and JRE",
    "versions": [
      {
        "version": "Oracle Java SE:8u381-perf",
        "status": "affected"
      },
      {
        "version": "Oracle Java SE:17.0.8",
        "status": "affected"
      },
      {
        "version": "Oracle Java SE:21",
        "status": "affected"
      },
      {
        "version": "Oracle GraalVM for JDK:17.0.8",
        "status": "affected"
      },
      {
        "version": "Oracle GraalVM for JDK:21",
        "status": "affected"
      },
      {
        "version": "Oracle GraalVM Enterprise Edition:21.3.7",
        "status": "affected"
      },
      {
        "version": "Oracle GraalVM Enterprise Edition:22.3.3",
        "status": "affected"
      }
    ]
  }
]