CVE-2022-21549 in Java SE
Summary
by MITRE • 07/20/2022
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 17.0.3.1; Oracle GraalVM Enterprise Edition: 21.3.2 and 22.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 05/28/2026
This vulnerability exists within the Oracle Java SE and Oracle GraalVM Enterprise Edition products, specifically affecting the Libraries component. The flaw impacts Oracle Java SE version 17.0.3.1 and Oracle GraalVM Enterprise Edition versions 21.3.2 and 22.1.0, representing a significant security concern for systems utilizing these platforms. The vulnerability classification as easily exploitable indicates that attackers can compromise affected systems without requiring authentication or specialized skills, making it particularly dangerous in production environments where these technologies are deployed.
The technical nature of this vulnerability stems from insufficient validation mechanisms within the Java libraries that handle code execution and data processing. Attackers can leverage multiple network protocols to exploit this weakness, bypassing traditional security controls that would normally protect against unauthorized data manipulation. The CVSS 3.1 score of 5.3 with integrity impacts reflects the potential for unauthorized update, insert, or delete operations against accessible data within the affected systems. This vulnerability specifically targets deployments where untrusted code is executed within sandboxed environments, including Java Web Start applications and applets that rely on Java sandbox security mechanisms for protection.
The operational impact of this vulnerability extends beyond simple data integrity concerns, as it represents a fundamental flaw in the security model of Java applications that depend on sandboxed execution environments. Systems running affected versions of Oracle Java SE or GraalVM Enterprise Edition are at risk of unauthorized data manipulation when they process untrusted input through web services or other API interfaces that utilize the vulnerable libraries. The attack vector through APIs and web services demonstrates how this vulnerability can be leveraged in modern cloud and web-based deployments where these Java components are commonly integrated.
Organizations should prioritize patching affected systems to address this vulnerability, as the ease of exploitation combined with the potential for data manipulation makes it a critical security concern. The vulnerability's applicability to sandboxed environments means that even systems that traditionally rely on Java security boundaries may be at risk. Security teams should conduct comprehensive assessments of their Java deployments to identify systems running the affected versions and implement appropriate mitigations including application firewalls, network segmentation, and monitoring for unauthorized data access patterns.
This vulnerability aligns with CWE-284 (Improper Access Control) and represents a specific instance of insufficient validation in Java library components. The ATT&CK framework categorizes this as a privilege escalation or data manipulation technique, potentially enabling adversaries to modify system data through legitimate application interfaces. Organizations should implement layered security approaches including runtime application self-protection, code integrity monitoring, and regular security assessments to mitigate the risk of exploitation. The vulnerability's impact on both Oracle Java SE and GraalVM Enterprise Edition deployments indicates that security teams must consider the entire Java ecosystem when implementing protective measures.