CVE-2023-22045: Vulnerability in the Oracle Java SE, Oracle GraalVM Enterpri..
debian, oracle
•
Jul 18, 2023
•
Sep 19, 2023
Description
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u371, 8u371-perf, 11.0.19, 17.0.7, 20.0.1; Oracle GraalVM Enterprise Edition: 20.3.10, 21.3.6, 22.3.2; Oracle GraalVM for JDK: 17.0.7 and 20.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).
Products affected:
oracle» graalvm » 20.3.10
oracle» graalvm » 21.3.6
oracle» graalvm » 22.3.2
oracle» graalvm_for_jdk » 17.0.7
oracle» graalvm_for_jdk » 20.0.1
oracle» jdk » 1.8.0
oracle» jdk » 1.8.0
oracle» jdk » 11.0.19
oracle» jdk » 17.0.7
oracle» jdk » 20.0.1
oracle» jre » 1.8.0
oracle» jre » 1.8.0
oracle» jre » 11.0.19
oracle» jre » 17.0.7
oracle» jre » 20.0.1
debian» debian_linux » 11.0
debian» debian_linux » 12.0
In a few clicks Akto can analyze your API attack surface and see what APIs are vulnerable to OWASP Top 10 and other common CWEs.
Severity
3.7
/
10
CVSS base metrics
Attack vector
NETWORK
Attack complexity
HIGH
Privileges required
HIGH
User interaction
NONE
Scope
UNCHANGED
Confidentiality
LOW
Integrity
NONE
Availability
NONE
Exploitability Score
2.2
Impact Score
1.4
Weakness
NVD-CWE-noinfo__
Learn from academy
Docker Metasploit
Metasploit WordPress
What is Metasploit?
Metasploit for Windows
Metasploit Linux
Armitage Metasploit
Termux Metasploit
Rapid7 Penetration Testing
Nmap Penetration Testing
Linux Penetration Testing
Salesforce Penetration Testing
Kubernetes Pentesting
IoT Penetration Testing
SAP Penetration Testing
Docker Pentest
Pentera Pentesting
Infrastructure Penetration Testing
Cobalt Pentest
CREST Penetration Testing
CompTIA Pentest+ Certification
Azure Penetration Testing
AWS Penetration Testing
Firebase Pentest
External Pen Testing
Hardware Penetration Testing
Android Pentesting
HTML Injection
Code Injection
Blind SQL Injection
HTTP Header Injection
LDAP Injection
PHP Injection
Command Injection
NoSQL Injection
Authentication Methods
Brute Force Attack
What is Fuzzing and How Does It Work?
What is API Fuzzing?
What is Fuzzer?
White Box Fuzzing
Related tests
JWT authentication bypass via jku header injection
eSMTP - Config Discovery
Nginx - Git Configuration Exposure
Laravel - Sensitive Information Disclosure
Docker Container - Misconfiguration Exposure
Msmtp - Config Exposure
Parameters.yml - File Discovery
Mongo Express - Unauthenticated Access
Apache Airflow Configuration Exposure
Dockerrun AWS Configuration Exposure
Apache Config file disclosure
Appspec Yml Disclosure
Explore more from Akto
Blog
Be updated about everything related to API Security, new API vulnerabilities, industry news and product updates.
Test Library
Discover and find tests from Akto's 100+ API Security test library. Choose your template or add a new template to start your API Security testing.
Documentation
Check out Akto's product documentation for all information related to features and how to use them.