« Volver al listado

CVE-2023-22043

Estado: ModificadaMedia (5.9)—

Vulnerabilidad en Oracle Java SE (componente: JavaFX). La versión compatible que resulta afectada es Oracle Java SE: 8u371. Una vulnerabilidad difícil de explotar permite a un atacante no autenticado con acceso a la red mediante múltiples protocolos comprometer Oracle Java SE. Los ataques con éxito contra esta vulnerabilidad pueden provocar la creación, eliminación o modificación no autorizada de datos críticos o de todos los datos accesibles de Oracle Java SE.

Leer descripción completaMostrar menos

Nota: Esta vulnerabilidad afecta a los despliegues de Java, normalmente en clientes que ejecutan aplicaciones Java Web Start en entorno aislado (sandbox) o applets de Java en entorno aislado (sandbox), que cargan y ejecutan código no fiable (por ejemplo, código procedente de internet) y dependen del entorno aislado de Java para la seguridad. Esta vulnerabilidad no afecta a los despliegues de Java, normalmente en servidores, que cargan y ejecutan únicamente código fiable (por ejemplo, código instalado por un administrador). Puntuación base CVSS 3.1 de 5.9 (impactos en la integridad). Vector CVSS: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).

Traducción automática del texto original de NVD (en inglés).

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Oracle — JDKOracle — JRE

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-22043",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-22043",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-09-13T16:29:03.333200Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "secalert_us@oracle.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.9,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.2
      }
    ]
  },
  "affected": [
    {
      "source": "secalert_us@oracle.com",
      "affectedData": [
        {
          "vendor": "Oracle Corporation",
          "product": "Java SE JDK and JRE",
          "versions": [
            {
              "status": "affected",
              "version": "Oracle Java SE:8u371"
            }
          ]
        }
      ]
    }
  ],
  "published": "2023-07-18T21:15:14.113",
  "references": [
    {
      "url": "https://security.netapp.com/advisory/ntap-20230725-0006/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "https://www.oracle.com/security-alerts/cpujul2023.html",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "https://security.netapp.com/advisory/ntap-20230725-0006/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.oracle.com/security-alerts/cpujul2023.html",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Vulnerability in Oracle Java SE (component: JavaFX).   The supported version that is affected is Oracle Java SE: 8u371. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 5.9 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)."
    }
  ],
  "lastModified": "2026-06-17T05:34:36.963",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oracle:jdk:1.8.0:update371:*:*:-:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5D736709-DA37-4A09-B0E9-ABE12512DD6F"
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:1.8.0:update371:*:*:-:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "12264955-3C82-413F-B814-C5538470DE13"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secalert_us@oracle.com"
}