CVE-2023-22006 — Path Traversal in Corporation Java SE JDK AND JRE

CWE-22 — Path Traversal11 documents8 sources
Severity
3.1LOWNVD
EPSS
0.1%
top 64.77%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
6
Oracle Corporation Java SE JDK AND JREDebian LinuxOracle Graalvm+3 more
Timeline
PublishedJul 18
Latest updateAug 30

Description

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 11.0.19, 17.0.7, 20.0.1; Oracle GraalVM Enterprise Edition: 20.3.10, 21.3.6, 22.3.2; Oracle GraalVM for JDK: 17.0.7 and 20.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edi…

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:NExploitability: 1.6 | Impact: 1.4

Affected Packages4 packages

▶NVDoracle/graalvm5 versions+4
▶NVDoracle/jdk11.0.19, 17.0.7, 20.0.1+2
▶NVDoracle/jre11.0.19, 17.0.7, 20.0.1+2

Also affects: Debian Linux 10.0, 11.0, 12.0

Patches

Patch: www.oracle.com ↗Patch: www.oracle.com ↗

🔴Vulnerability Details

5
OSV
openjdk-lts, openjdk-17 regression↗2023-08-30
▶
OSV
openjdk-8, openjdk-lts, openjdk-17 vulnerabilities↗2023-08-01
▶
GHSA
GHSA-c36p-x44h-8wcq: Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Networking)↗2023-07-18
▶
OSV
CVE-2023-22006: Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Networking)↗2023-07-18
▶
CVEList
CVE-2023-22006: Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Networking)↗2023-07-18
▶

📋Vendor Advisories

5
Ubuntu
OpenJDK 20 vulnerabilities↗2023-08-03
▶
Ubuntu
OpenJDK vulnerabilities↗2023-08-01
▶
Red Hat
OpenJDK: HTTP client insufficient file name validation (8302475)↗2023-07-18
▶
Oracle
Oracle Oracle Java SE Risk Matrix: Networking — CVE-2023-22006↗2023-07-15
▶
Debian
CVE-2023-22006: openjdk-11 - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle G...↗2023
▶