Loading HuntDB...
Hunt
Vulnerability Intelligence by wss.sh
Home Daily Briefings High Impact CVEs Recent Exploits KEV Catalog GitHub Advisories Latest Updates Security News
Sign In Sign Up

CVE-2021-35559

MEDIUM
Published 2021-10-20T10:50:07
Actions:

Expert Analysis

Professional remediation guidance

Get tailored security recommendations from our analyst team for CVE-2021-35559. We'll provide specific mitigation strategies based on your environment and risk profile.

CVSS Score

V3.1
5.3
/10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Base Score Metrics
Exploitability: N/A Impact: N/A

EPSS Score

v2023.03.01
0.003
probability
of exploitation in the wild

There is a 0.3% chance that this vulnerability will be exploited in the wild within the next 30 days.

Updated: 2025-01-25
Exploit Probability
Percentile: 0.645
Higher than 64.5% of all CVEs

Attack Vector Metrics

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED

Impact Metrics

Confidentiality
NONE
Integrity
NONE
Availability
LOW

Description

Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Swing). Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

Available Exploits

No exploits available for this CVE.

Related News

No news articles found for this CVE.

Affected Products

Oracle Corporation

Java SE JDK and JRE

Affected Versions:

Java SE:7u311 Java SE:8u301 Java SE:11.0.12 Java SE:17 Oracle GraalVM Enterprise Edition:20.3.3 Oracle GraalVM Enterprise Edition:21.2.0
oracle

java_se

Affected Versions:

7u311
oracle

java_se

Affected Versions:

8u301
oracle

java_se

Affected Versions:

11.0.12
oracle

java_se

Affected Versions:

17
oracle

jdk

Affected Versions:

7u311
oracle

jdk

Affected Versions:

8u301
oracle

jdk

Affected Versions:

11.0.12
oracle

jdk

Affected Versions:

17
oracle

jre

Affected Versions:

7u311
oracle

jre

Affected Versions:

8u301
oracle

jre

Affected Versions:

11.0.12
oracle

jre

Affected Versions:

17
oracle

jre

Affected Versions:

oracle_graalvm_enterprise_edition_20.3.3
oracle

jre

Affected Versions:

oracle_graalvm_enterprise_edition_21.2.0
oracle

jdk

Affected Versions:

oracle_graalvm_enterprise_edition_20.3.3
oracle

java_se

Affected Versions:

oracle_graalvm_enterprise_edition_20.3.3
oracle

java_se

Affected Versions:

oracle_graalvm_enterprise_edition_21.2.0
oracle

jdk

Affected Versions:

oracle_graalvm_enterprise_edition_21.2.0

GitHub Security Advisories

Community-driven vulnerability intelligence from GitHub

⚠ Unreviewed MODERATE

GHSA-q7w5-cq9g-vhw8

Advisory Details

Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Swing). Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

CVSS Scoring

CVSS Score

5.0

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2021-35559
WEB https://www.oracle.com/security-alerts/cpuoct2021.html
WEB https://www.debian.org/security/2021/dsa-5012
WEB https://www.debian.org/security/2021/dsa-5000
WEB https://security.netapp.com/advisory/ntap-20240621-0006
WEB https://security.netapp.com/advisory/ntap-20211022-0004
WEB https://security.gentoo.org/glsa/202209-05
WEB https://lists.fedoraproject.org/archives/list/[email protected]/message/V362B2BWTH5IJDL45QPQGMBKIQOG7JX5
WEB https://lists.fedoraproject.org/archives/list/[email protected]/message/GXTUWAWXVU37GRNIG4TPMA47THO6VAE6
WEB https://lists.fedoraproject.org/archives/list/[email protected]/message/GTYZWIXDFUV2H57YQZJWPOD3BC3I3EIQ
WEB https://lists.fedoraproject.org/archives/list/[email protected]/message/DJILEHYV2U37HKMGFEQ7CAVOV4DUWW2O
WEB https://lists.fedoraproject.org/archives/list/[email protected]/message/7WTVCIVHTX3XONYOEGUMLKCM4QEC6INT
WEB https://lists.fedoraproject.org/archives/list/[email protected]/message/6EUURAQOIJYFZHQ7DFZCO6IKDPIAWTNK
WEB https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V362B2BWTH5IJDL45QPQGMBKIQOG7JX5
WEB https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GXTUWAWXVU37GRNIG4TPMA47THO6VAE6
WEB https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTYZWIXDFUV2H57YQZJWPOD3BC3I3EIQ
WEB https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DJILEHYV2U37HKMGFEQ7CAVOV4DUWW2O
WEB https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7WTVCIVHTX3XONYOEGUMLKCM4QEC6INT
WEB https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6EUURAQOIJYFZHQ7DFZCO6IKDPIAWTNK
WEB https://lists.debian.org/debian-lts-announce/2021/11/msg00008.html

Advisory provided by GitHub Security Advisory Database. Published: May 24, 2022, Modified: June 21, 2024

References

https://www.oracle.com/security-alerts/cpuoct2021.html
https://security.netapp.com/advisory/ntap-20211022-0004/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7WTVCIVHTX3XONYOEGUMLKCM4QEC6INT/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTYZWIXDFUV2H57YQZJWPOD3BC3I3EIQ/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V362B2BWTH5IJDL45QPQGMBKIQOG7JX5/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6EUURAQOIJYFZHQ7DFZCO6IKDPIAWTNK/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DJILEHYV2U37HKMGFEQ7CAVOV4DUWW2O/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GXTUWAWXVU37GRNIG4TPMA47THO6VAE6/
https://www.debian.org/security/2021/dsa-5000
https://lists.debian.org/debian-lts-announce/2021/11/msg00008.html
https://www.debian.org/security/2021/dsa-5012
https://security.gentoo.org/glsa/202209-05
https://security.netapp.com/advisory/ntap-20240621-0006/
Published: 2021-10-20T10:50:07
Last Modified: 2024-08-04T00:40:46.850Z
Copied to clipboard!