Search for vulnerabilities
Vulnerability details: VCID-vrgz-jwc7-aaaa
Vulnerability ID VCID-vrgz-jwc7-aaaa
Aliases CVE-2023-22049
Summary Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 8u371, 8u371-perf, 11.0.19, 17.0.7, 20.0.1; Oracle GraalVM Enterprise Edition: 20.3.10, 21.3.6, 22.3.2; Oracle GraalVM for JDK: 17.0.7 and 20.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).
Status Published
Exploitability 0.5
Weighted Severity 3.3
Risk 1.6
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
System Score Found at
cvssv3 3.7 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-22049.json
epss 0.00049 https://api.first.org/data/v1/epss?cve=CVE-2023-22049
epss 0.00049 https://api.first.org/data/v1/epss?cve=CVE-2023-22049
epss 0.00049 https://api.first.org/data/v1/epss?cve=CVE-2023-22049
epss 0.00049 https://api.first.org/data/v1/epss?cve=CVE-2023-22049
epss 0.00069 https://api.first.org/data/v1/epss?cve=CVE-2023-22049
epss 0.00069 https://api.first.org/data/v1/epss?cve=CVE-2023-22049
epss 0.00069 https://api.first.org/data/v1/epss?cve=CVE-2023-22049
epss 0.00069 https://api.first.org/data/v1/epss?cve=CVE-2023-22049
epss 0.00069 https://api.first.org/data/v1/epss?cve=CVE-2023-22049
epss 0.00069 https://api.first.org/data/v1/epss?cve=CVE-2023-22049
epss 0.00069 https://api.first.org/data/v1/epss?cve=CVE-2023-22049
epss 0.00069 https://api.first.org/data/v1/epss?cve=CVE-2023-22049
epss 0.00069 https://api.first.org/data/v1/epss?cve=CVE-2023-22049
epss 0.00069 https://api.first.org/data/v1/epss?cve=CVE-2023-22049
epss 0.00069 https://api.first.org/data/v1/epss?cve=CVE-2023-22049
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2023-22049
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2023-22049
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2023-22049
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2023-22049
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2023-22049
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2023-22049
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2023-22049
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2023-22049
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2023-22049
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2023-22049
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2023-22049
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2023-22049
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2023-22049
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2023-22049
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2023-22049
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2023-22049
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2023-22049
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2023-22049
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2023-22049
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2023-22049
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2023-22049
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2023-22049
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2023-22049
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2023-22049
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2023-22049
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2023-22049
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2023-22049
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2023-22049
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2023-22049
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2023-22049
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2023-22049
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2023-22049
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2023-22049
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2023-22049
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2023-22049
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2023-22049
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2023-22049
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2023-22049
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2023-22049
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2023-22049
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2023-22049
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2023-22049
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2023-22049
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2023-22049
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2023-22049
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2023-22049
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2023-22049
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2023-22049
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2023-22049
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2023-22049
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2023-22049
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2023-22049
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2023-22049
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2023-22049
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2023-22049
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2023-22049
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2023-22049
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2023-22049
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2023-22049
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2023-22049
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2023-22049
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2023-22049
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2023-22049
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2023-22049
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2023-22049
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2023-22049
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2023-22049
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2023-22049
epss 0.00486 https://api.first.org/data/v1/epss?cve=CVE-2023-22049
cvssv3.1 3.7 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3 3.7 https://nvd.nist.gov/vuln/detail/CVE-2023-22049
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-22049.json
https://api.first.org/data/v1/epss?cve=CVE-2023-22049
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21930
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21937
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21938
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21939
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21954
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21967
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21968
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22006
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22036
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22041
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22045
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22049
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://lists.debian.org/debian-lts-announce/2023/09/msg00018.html
https://security.netapp.com/advisory/ntap-20230725-0006/
https://security.netapp.com/advisory/ntap-20240621-0006/
https://www.debian.org/security/2023/dsa-5458
https://www.debian.org/security/2023/dsa-5478
https://www.oracle.com/security-alerts/cpujul2023.html
2221647 https://bugzilla.redhat.com/show_bug.cgi?id=2221647
cpe:2.3:a:netapp:7-mode_transition_tool:-:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:netapp:7-mode_transition_tool:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*
cpe:2.3:a:netapp:cloud_insights_acquisition_unit:-:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:netapp:cloud_insights_acquisition_unit:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:cloud_insights_storage_workload_security_agent:-:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:netapp:cloud_insights_storage_workload_security_agent:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*
cpe:2.3:a:oracle:graalvm:20.3.10:*:*:*:enterprise:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:graalvm:20.3.10:*:*:*:enterprise:*:*:*
cpe:2.3:a:oracle:graalvm:21.3.6:*:*:*:enterprise:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:graalvm:21.3.6:*:*:*:enterprise:*:*:*
cpe:2.3:a:oracle:graalvm:22.3.2:*:*:*:enterprise:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:graalvm:22.3.2:*:*:*:enterprise:*:*:*
cpe:2.3:a:oracle:graalvm_for_jdk:17.0.7:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:graalvm_for_jdk:17.0.7:*:*:*:*:*:*:*
cpe:2.3:a:oracle:graalvm_for_jdk:20.0.1:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:graalvm_for_jdk:20.0.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:11.0.19:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:jdk:11.0.19:*:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:17.0.7:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:jdk:17.0.7:*:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.8.0:update371:*:*:-:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:jdk:1.8.0:update371:*:*:-:*:*:*
cpe:2.3:a:oracle:jdk:1.8.0:update371:*:*:enterprise_performance_pack:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:jdk:1.8.0:update371:*:*:enterprise_performance_pack:*:*:*
cpe:2.3:a:oracle:jdk:20.0.1:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:jdk:20.0.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:11.0.19:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:jre:11.0.19:*:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:17.0.7:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:jre:17.0.7:*:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.8.0:update371:*:*:-:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:jre:1.8.0:update371:*:*:-:*:*:*
cpe:2.3:a:oracle:jre:1.8.0:update371:*:*:enterprise_performance_pack:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:jre:1.8.0:update371:*:*:enterprise_performance_pack:*:*:*
cpe:2.3:a:oracle:jre:20.0.1:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:jre:20.0.1:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*
CVE-2023-22049 https://nvd.nist.gov/vuln/detail/CVE-2023-22049
GLSA-202407-24 https://security.gentoo.org/glsa/202407-24
GLSA-202412-07 https://security.gentoo.org/glsa/202412-07
RHSA-2023:4157 https://access.redhat.com/errata/RHSA-2023:4157
RHSA-2023:4158 https://access.redhat.com/errata/RHSA-2023:4158
RHSA-2023:4159 https://access.redhat.com/errata/RHSA-2023:4159
RHSA-2023:4161 https://access.redhat.com/errata/RHSA-2023:4161
RHSA-2023:4162 https://access.redhat.com/errata/RHSA-2023:4162
RHSA-2023:4163 https://access.redhat.com/errata/RHSA-2023:4163
RHSA-2023:4164 https://access.redhat.com/errata/RHSA-2023:4164
RHSA-2023:4165 https://access.redhat.com/errata/RHSA-2023:4165
RHSA-2023:4166 https://access.redhat.com/errata/RHSA-2023:4166
RHSA-2023:4167 https://access.redhat.com/errata/RHSA-2023:4167
RHSA-2023:4168 https://access.redhat.com/errata/RHSA-2023:4168
RHSA-2023:4169 https://access.redhat.com/errata/RHSA-2023:4169
RHSA-2023:4170 https://access.redhat.com/errata/RHSA-2023:4170
RHSA-2023:4171 https://access.redhat.com/errata/RHSA-2023:4171
RHSA-2023:4172 https://access.redhat.com/errata/RHSA-2023:4172
RHSA-2023:4173 https://access.redhat.com/errata/RHSA-2023:4173
RHSA-2023:4174 https://access.redhat.com/errata/RHSA-2023:4174
RHSA-2023:4175 https://access.redhat.com/errata/RHSA-2023:4175
RHSA-2023:4176 https://access.redhat.com/errata/RHSA-2023:4176
RHSA-2023:4177 https://access.redhat.com/errata/RHSA-2023:4177
RHSA-2023:4178 https://access.redhat.com/errata/RHSA-2023:4178
RHSA-2023:4208 https://access.redhat.com/errata/RHSA-2023:4208
RHSA-2023:4209 https://access.redhat.com/errata/RHSA-2023:4209
RHSA-2023:4210 https://access.redhat.com/errata/RHSA-2023:4210
RHSA-2023:4211 https://access.redhat.com/errata/RHSA-2023:4211
RHSA-2023:4212 https://access.redhat.com/errata/RHSA-2023:4212
RHSA-2023:4233 https://access.redhat.com/errata/RHSA-2023:4233
RHSA-2023:4876 https://access.redhat.com/errata/RHSA-2023:4876
RHSA-2023:4877 https://access.redhat.com/errata/RHSA-2023:4877
USN-6263-1 https://usn.ubuntu.com/6263-1/
USN-6272-1 https://usn.ubuntu.com/6272-1/
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-22049.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2023-22049
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.20159
EPSS Score 0.00049
Published At Dec. 17, 2024, midnight
Date Actor Action Source VulnerableCode Version
There are no relevant records.