CVE-2022-21449 Public exploit High · 7.5 EPSS 77.2%

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries)

Oracle Corporation · Java SE JDK and JRE

Official description · CVE.org

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 17.0.2 and 18; Oracle GraalVM Enterprise Edition: 21.3.1 and 22.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).

Breakdown

31.9 / 100

Exploited: Not confirmed
Reports: 0
Tactics: 0/15

Public exploit code (PoC-in-GitHub) appeared 1 day after disclosure. No confirmed exploitation is recorded.

Disclosed19 Apr 2022day 0
Public exploit codePoC-in-GitHub20 Apr 2022+1 day

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

What security researchers reported

Not named in any threat report yet

Also mentioned in 5 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

References

18 links, grouped by NVD tag

x_refsource_MISC 1

oracle.com/security-alerts/cpuapr2022.html

mailing-list 14

openwall.com/lists/oss-security/2022/04/28/2 openwall.com/lists/oss-security/2022/04/28/3 openwall.com/lists/oss-security/2022/04/28/4 openwall.com/lists/oss-security/2022/04/28/5 openwall.com/lists/oss-security/2022/04/28/6 openwall.com/lists/oss-security/2022/04/28/7 openwall.com/lists/oss-security/2022/04/29/1 openwall.com/lists/oss-security/2022/04/30/1

Show 6 moreShow fewer

openwall.com/lists/oss-security/2022/04/30/2 openwall.com/lists/oss-security/2022/04/30/4 openwall.com/lists/oss-security/2022/04/30/3 openwall.com/lists/oss-security/2022/05/01/1 openwall.com/lists/oss-security/2022/05/01/2 openwall.com/lists/oss-security/2022/05/02/1

x_refsource_CONFIRM 1

security.netapp.com/advisory/ntap-20220429-0006/

vendor-advisory 2

debian.org/security/2022/dsa-5128 debian.org/security/2022/dsa-5131

Exploitation evidence

Not in KEV. CISA has not confirmed exploitation.

ENISA

Not marked exploited. EUVD-2022-26673

Public exploitAdvisories link exploit code.

, 30 Oct 2026

77.2%Top 0.45%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 99.55%).

3.1

7.5High · 7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Priority factorsFormula

In a KEV catalognot listed 0.0/35

Recent KEV listingnot listed 0.0/10

Known ransomware usenot known 0.0/10

EPSS percentilepercentile 0.9955 19.9/20

Threat reports0 reports 0.0/10

Public exploit code10 PoC-in-GitHub repos 5.0/5

Mentioned in OTX pulses5 pulses 1.8/3

CVSS base scorebase score 7.5 5.3/7

End-of-life productsupported or unknown 0.0

Total31.9

Record

Published: 19 Apr 2022
Modified: 24 Sep 2024
: None assigned
Elsewhere: NVD CVE.org JSON