JavaScript Vulnerability in Oracle GraalVM Enterprise Edition
CVE-2022-21597

5.3MEDIUM

Key Information:

Vendor
Oracle
Status
Graalvm Enterprise Edition
Vendor
CVE Published:
18 October 2022

Summary

A vulnerability exists in the JavaScript component of Oracle GraalVM Enterprise Edition that allows an unauthenticated attacker with network access to compromise the software. This issue can lead to unauthorized read access to sensitive data within the affected versions of Oracle GraalVM Enterprise Edition, specifically 20.3.7, 21.3.3, and 22.2.0. It highlights the potential risks associated with unsecured network access and emphasizes the need for timely mitigation measures.

Affected Version(s)

GraalVM Enterprise Edition Oracle GraalVM Enterprise Edition:20.3.7

GraalVM Enterprise Edition Oracle GraalVM Enterprise Edition:21.3.3

GraalVM Enterprise Edition Oracle GraalVM Enterprise Edition:22.2.0

References

https://www.oracle.com/security-alerts/cpuoct2022.html

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.