CVE-2023-22051

Vulnerability in the Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: GraalVM Compiler). Supported versions that are affected are Oracle GraalVM Enterprise Edition: 21.3.6, 22.3.2; Oracle GraalVM for JDK: 17.0.7 and 20.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK accessible data. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).

CVSS v3 3.7 LOW

3.7^/10

CVSS v3 : LOW

Vector :

Exploitability : 2.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.oracle.com/security-alerts/cpujul2023.html	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:oracle:graalvm:21.3.6::::enterprise:::
	cpe:2.3:a:oracle:graalvm:22.3.2::::enterprise:::
	cpe:2.3:a:oracle:graalvm_for_jdk:17.0.7:::::::*
	cpe:2.3:a:oracle:graalvm_for_jdk:20.0.1:::::::*

History

No history.

Information

Published : 2023-07-18 21:15

Updated : 2023-07-27 19:49

NVD link : CVE-2023-22051

Mitre link : CVE-2023-22051

CVE.ORG link : CVE-2023-22051

JSON object : View

Products Affected

oracle

graalvm_for_jdk
graalvm

CWE

NVD-CWE-noinfo

{"id": "CVE-2023-22051", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "secalert_us@oracle.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.2}]}, "published": "2023-07-18T21:15:14.767", "references": [{"url": "https://www.oracle.com/security-alerts/cpujul2023.html", "tags": ["Patch", "Vendor Advisory"], "source": "secalert_us@oracle.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "Vulnerability in the Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: GraalVM Compiler). Supported versions that are affected are Oracle GraalVM Enterprise Edition: 21.3.6, 22.3.2; Oracle GraalVM for JDK: 17.0.7 and 20.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK accessible data. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)."}], "lastModified": "2023-07-27T19:49:02.660", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:oracle:graalvm:21.3.6:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "1612C1DD-47B7-4A52-B709-0E270CE9A814"}, {"criteria": "cpe:2.3:a:oracle:graalvm:22.3.2:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "0D052622-1214-4B93-8638-8F0FBADD4F43"}, {"criteria": "cpe:2.3:a:oracle:graalvm_for_jdk:17.0.7:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "908FCFE7-F95A-4E5C-8644-78E737828E27"}, {"criteria": "cpe:2.3:a:oracle:graalvm_for_jdk:20.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6FC3A3A8-4244-4933-AC2C-03540C9F80BE"}], "operator": "OR"}]}], "sourceIdentifier": "secalert_us@oracle.com"}