Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.3

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0....

CVE-2022-21271 · published 4 years ago
Summary

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unaut...

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
Ecosystem VendorProductAffected versions
– oracle graalvm 20.3.4
21.3.0
cpe:2.3:a:oracle:graalvm:20.3.4:*:*:*:enterprise:*:*:*
– oracle http_server 12.2.1.3.0
12.2.1.4.0
cpe:2.3:a:oracle:http_server:12.2.1.3.0:*:*:*:*:*:*:*
– oracle jdk 1.7.0
1.8.0
11.0.13
cpe:2.3:a:oracle:jdk:1.7.0:update321:*:*:*:*:*:*
– oracle jre 1.7.0
1.8.0
11.0.13
cpe:2.3:a:oracle:jre:1.7.0:update321:*:*:*:*:*:*
– oracle zfs_storage_appliance_kit 8.8
cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:*:*:*:*:*:*:*
– oracle solaris 11
cpe:2.3:o:oracle:solaris:11:*:*:*:*:*:*:*
– netapp 7-mode_transition_tool All versions
cpe:2.3:a:netapp:7-mode_transition_tool:-:*:*:*:*:*:*:*
– netapp active_iq_unified_manager All versions
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
– netapp cloud_insights_acquisition_unit All versions
cpe:2.3:a:netapp:cloud_insights_acquisition_unit:-:*:*:*:*:*:*:*
– netapp cloud_secure_agent All versions
cpe:2.3:a:netapp:cloud_secure_agent:-:*:*:*:*:*:*:*
– netapp e-series_santricity_os_controller >= 11.0.0, <= 11.70.1
cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:*
– netapp e-series_santricity_storage_manager All versions
cpe:2.3:a:netapp:e-series_santricity_storage_manager:-:*:*:*:*:*:*:*
– netapp e-series_santricity_web_services All versions
cpe:2.3:a:netapp:e-series_santricity_web_services:-:*:*:*:*:web_services_proxy:*:*
– netapp hci_management_node All versions
cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*
– netapp oncommand_insight All versions
cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*
– netapp oncommand_workflow_automation All versions
cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*
– netapp santricity_unified_manager All versions
cpe:2.3:a:netapp:santricity_unified_manager:-:*:*:*:*:*:*:*
– netapp snapmanager All versions
cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:oracle:*:*
– netapp solidfire All versions
cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*
Ubuntu:16.04:LTS canonical icedtea-web All versions
Original advisory text
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0....
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
5.3 Medium
Exploitation
3% chance of attack within 30 days
Timeline
Published19 Jan 2022
Updated30 Oct 2026
First seen29 Sep 2026
Sources
CVE-2022-21271 · NVD
UBUNTU-CVE-2022-21271 · OSV
CVE-2022-21271 · OSV
Track software like this
Free during beta