CVE-2022-21294

中 5.3CVE-2022-21294 · 19/01/2022 公開 · 17/06/2026 更新

要点

CVE-2022-21294 は e-series santricity os controller (netapp), graalvm (oracle), jdk (oracle) に影響する深刻度「中」 (CVSS 5.3) の脆弱性です。
今後30日間に悪用される確率（EPSS）：3.4%（全脆弱性の 88.7% より高い）。
修正版の情報はまだありません。参考情報のベンダー勧告を確認してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
e-series santricity os controller netapp	`≥ 11.0.0, ≤ 11.70.1`	修正版なし
graalvm oracle	`= 20.3.4= 21.3.0`	修正版なし
jdk oracle	`= 1.7.0= 1.8.0= 11.0.13= 17.0.1`	修正版なし
jre oracle	`= 1.7.0= 1.8.0= 11.0.13= 17.0.1`	修正版なし
openjdk oracle	`= 17= 17.0.1= 7= 8≥ 11, ≤ 11.0.13≥ 13, ≤ 13.0.9≥ 15, ≤ 15.0.5`	修正版なし

概要

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).