Attacker Value

Unknown

(0 users assessed)

Exploitability

Unknown

(0 users assessed)

User Interaction

Required

Privileges Required

None

Attack Vector

Network

0

CVE-2019-2422

Disclosure Date: January 16, 2019 •

CVE-2019-2422 CVSS v3 Base Score: 3.1

MITRE ATT&CK

Add MITRE ATT&CK tactics and techniques that apply to this CVE.

Description

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE: 7u201, 8u192 and 11.0.1; Java SE Embedded: 8u191. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 3.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N).

Add Assessment

No one has assessed this topic. Be the first to add your voice to the community.

CVSS V3 Severity and Metrics

Data provided by the National Vulnerability Database (NVD)

Base Score:

3.1 Low

Impact Score:

1.4

Exploitability Score:

1.6

Vector:

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Attack Vector (AV):

Network

Attack Complexity (AC):

High

Privileges Required (PR):

None

User Interaction (UI):

Required

Scope (S):

Unchanged

Confidentiality (C):

Low

Integrity (I):

None

Availability (A):

None

Vendors

canonical,
debian,
hp,
netapp,
opensuse,
oracle,
redhat

Products

References

Canonical

CVE-2019-2422 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-2422)

BID-106596 (http://www.securityfocus.com/bid/106596)

Advisory

https://access.redhat.com/errata/RHSA-2019:0462

https://access.redhat.com/errata/RHSA-2019:0464

https://security.netapp.com/advisory/ntap-20190118-0001

https://access.redhat.com/errata/RHSA-2019:0435

https://access.redhat.com/errata/RHSA-2019:0416

GLSA-201903-14 (https://security.gentoo.org/glsa/201903-14)

https://access.redhat.com/errata/RHSA-2019:0474

http://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html

https://access.redhat.com/errata/RHSA-2019:0469

USN-3875-1 (https://usn.ubuntu.com/3875-1)

https://access.redhat.com/errata/RHSA-2019:0473

https://access.redhat.com/errata/RHSA-2019:0472

https://access.redhat.com/errata/RHSA-2019:0436

http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00028.html

20190320 [SECURITY] [DSA 4410-1] openjdk-8 security update (https://seclists.org/bugtraq/2019/Mar/27)

DSA-4410 (https://www.debian.org/security/2019/dsa-4410)

https://access.redhat.com/errata/RHSA-2019:0640

[debian-lts-announce] 20190327 [SECURITY] [DLA 1732-1] openjdk-7 security update (https://lists.debian.org/debian-lts-announce/2019/03/msg00033.html)

USN-3942-1 (https://usn.ubuntu.com/3942-1)

USN-3949-1 (https://usn.ubuntu.com/3949-1)

https://access.redhat.com/errata/RHSA-2019:1238

http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00059.html

http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00013.html

https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03958en_us

Rapid7

Technical Analysis