Incorrect authorization in Oracle Java SE JDK and JRE
Priority LOW 32CWE-863Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Partial Red Hat: 28 fixed, 3 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-863.
Summary
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: CORBA). Supported versions that are affected are Oracle Java SE: 8u381, 8u381-perf; Oracle GraalVM Enterprise Edition: 20.3.11 and 21.3.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via CORBA to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01051 64th percentileScored 2026-11-07
Fix Partial Red Hat: 12 advisoriesRed Hat: 28 fixed, 3 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Oracle | Java SE JDK and JRE | Oracle Java SE:8u381; Oracle Java SE:8u381-perf; Oracle GraalVM Enterprise Edition:20.3.11; Oracle GraalVM Enterprise Edition:21.3.7 | — | No fix listed | CNA |
- Java SE JDK and JRE VendorOracle Affected Oracle Java SE:8u381; Oracle Java SE:8u381-perf; Oracle GraalVM Enterprise Edition:20.3.11; Oracle GraalVM Enterprise Edition:21.3.7 Fixed in — No fix listed CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:oracle:jdk:1.8.0:update381:*:*:-:*:*:* | 1.8.0 update381 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:jdk:1.8.0:update381:*:*:enterprise_performance_pack:*:*:* | 1.8.0 update381 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:jre:1.8.0:update381:*:*:-:*:*:* | 1.8.0 update381 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:jre:1.8.0:update381:*:*:enterprise_performance_pack:*:*:* | 1.8.0 update381 | Vulnerable | Oracle |
| cpe:2.3:a:netapp:cloud_insights_acquisition_unit:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:cloud_insights_storage_workload_security_agent:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
- cpe:2.3:a:oracle:jdk:1.8.0:update381:*:*:-:*:*:* Versions 1.8.0 update381 Vulnerable ·Oracle
- cpe:2.3:a:oracle:jdk:1.8.0:update381:*:*:enterprise_performance_pack:*:*:* Versions 1.8.0 update381 Vulnerable ·Oracle
- cpe:2.3:a:oracle:jre:1.8.0:update381:*:*:-:*:*:* Versions 1.8.0 update381 Vulnerable ·Oracle
- cpe:2.3:a:oracle:jre:1.8.0:update381:*:*:enterprise_performance_pack:*:*:* Versions 1.8.0 update381 Vulnerable ·Oracle
- cpe:2.3:a:netapp:cloud_insights_acquisition_unit:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:cloud_insights_storage_workload_security_agent:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
Remediation
Red Hat 12 advisories
- RHSA-2024:0879 Released 2024-02-20 · Red Hat rating Moderatejava-1.8.0-ibm security update
- Red Hat Enterprise Linux Client Supplementary (v. 7) java-1.8.0-ibm-1:1.8.0.8.15-1jpp.1.el7, java-1.8.0-ibm-demo-1:1.8.0.8.15-1jpp.1.el7, java-1.8.0-ibm-devel-1:1.8.0.8.15-1jpp.1.el7 +3
- Red Hat Enterprise Linux ComputeNode Supplementary (v. 7) java-1.8.0-ibm-1:1.8.0.8.15-1jpp.1.el7, java-1.8.0-ibm-demo-1:1.8.0.8.15-1jpp.1.el7, java-1.8.0-ibm-devel-1:1.8.0.8.15-1jpp.1.el7 +1
- Red Hat Enterprise Linux Server Supplementary (v. 7) java-1.8.0-ibm-1:1.8.0.8.15-1jpp.1.el7, java-1.8.0-ibm-demo-1:1.8.0.8.15-1jpp.1.el7, java-1.8.0-ibm-devel-1:1.8.0.8.15-1jpp.1.el7 +3
- Red Hat Enterprise Linux Workstation Supplementary (v. 7) java-1.8.0-ibm-1:1.8.0.8.15-1jpp.1.el7, java-1.8.0-ibm-demo-1:1.8.0.8.15-1jpp.1.el7, java-1.8.0-ibm-devel-1:1.8.0.8.15-1jpp.1.el7 +3
- RHSA-2024:0866 Released 2024-02-19 · Red Hat rating Moderatejava-1.8.0-ibm security update
- Red Hat Enterprise Linux Supplementary (v. 8) java-1.8.0-ibm-1:1.8.0.8.15-1.el8_9, java-1.8.0-ibm-demo-1:1.8.0.8.15-1.el8_9, java-1.8.0-ibm-devel-1:1.8.0.8.15-1.el8_9 +5
- RHSA-2023:5730 Released 2023-10-18 · Red Hat rating Moderatejava-1.8.0-openjdk security update
- Red Hat CodeReady Linux Builder EUS (v.8.6) java-1.8.0-openjdk-accessibility-fastdebug-1:1.8.0.392.b08-2.el8_6, java-1.8.0-openjdk-accessibility-slowdebug-1:1.8.0.392.b08-2.el8_6, java-1.8.0-openjdk-demo-fastdebug-1:1.8.0.392.b08-2.el8_6 +9
- Red Hat Enterprise Linux AppStream EUS (v.8.6) java-1.8.0-openjdk-1:1.8.0.392.b08-2.el8_6, java-1.8.0-openjdk-accessibility-1:1.8.0.392.b08-2.el8_6, java-1.8.0-openjdk-demo-1:1.8.0.392.b08-2.el8_6 +5
Show 9 more Red Hat advisories
- RHSA-2023:5733 Released 2023-10-18 · Red Hat rating Moderatejava-1.8.0-openjdk security update
- Red Hat Enterprise Linux AppStream (v. 9) java-1.8.0-openjdk-1:1.8.0.392.b08-3.el9, java-1.8.0-openjdk-demo-1:1.8.0.392.b08-3.el9, java-1.8.0-openjdk-devel-1:1.8.0.392.b08-3.el9 +4
- Red Hat Enterprise Linux CRB (v. 9) java-1.8.0-openjdk-demo-fastdebug-1:1.8.0.392.b08-3.el9, java-1.8.0-openjdk-demo-slowdebug-1:1.8.0.392.b08-3.el9, java-1.8.0-openjdk-devel-fastdebug-1:1.8.0.392.b08-3.el9 +7
- RHSA-2023:5729 Released 2023-10-18 · Red Hat rating Moderatejava-1.8.0-openjdk security update
- Red Hat Enterprise Linux AppStream AUS (v.8.4) java-1.8.0-openjdk-1:1.8.0.392.b08-2.el8_4, java-1.8.0-openjdk-accessibility-1:1.8.0.392.b08-2.el8_4, java-1.8.0-openjdk-demo-1:1.8.0.392.b08-2.el8_4 +5
- Red Hat Enterprise Linux AppStream E4S (v.8.4) java-1.8.0-openjdk-1:1.8.0.392.b08-2.el8_4, java-1.8.0-openjdk-accessibility-1:1.8.0.392.b08-2.el8_4, java-1.8.0-openjdk-demo-1:1.8.0.392.b08-2.el8_4 +5
- Red Hat Enterprise Linux AppStream TUS (v.8.4) java-1.8.0-openjdk-1:1.8.0.392.b08-2.el8_4, java-1.8.0-openjdk-accessibility-1:1.8.0.392.b08-2.el8_4, java-1.8.0-openjdk-demo-1:1.8.0.392.b08-2.el8_4 +5
- RHSA-2023:5728 Released 2023-10-18 · Red Hat rating Moderatejava-1.8.0-openjdk security update
- Red Hat Enterprise Linux AppStream AUS (v. 8.2) java-1.8.0-openjdk-1:1.8.0.392.b08-2.el8_2, java-1.8.0-openjdk-accessibility-1:1.8.0.392.b08-2.el8_2, java-1.8.0-openjdk-demo-1:1.8.0.392.b08-2.el8_2 +5
- Red Hat Enterprise Linux AppStream E4S (v. 8.2) java-1.8.0-openjdk-1:1.8.0.392.b08-2.el8_2, java-1.8.0-openjdk-accessibility-1:1.8.0.392.b08-2.el8_2, java-1.8.0-openjdk-demo-1:1.8.0.392.b08-2.el8_2 +5
- Red Hat Enterprise Linux AppStream TUS (v. 8.2) java-1.8.0-openjdk-1:1.8.0.392.b08-2.el8_2, java-1.8.0-openjdk-accessibility-1:1.8.0.392.b08-2.el8_2, java-1.8.0-openjdk-demo-1:1.8.0.392.b08-2.el8_2 +5
- RHSA-2023:5732 Released 2023-10-18 · Red Hat rating Moderatejava-1.8.0-openjdk security update
- Red Hat CodeReady Linux Builder EUS (v.9.0) java-1.8.0-openjdk-demo-fastdebug-1:1.8.0.392.b08-2.el9_0, java-1.8.0-openjdk-demo-slowdebug-1:1.8.0.392.b08-2.el9_0, java-1.8.0-openjdk-devel-fastdebug-1:1.8.0.392.b08-2.el9_0 +7
- Red Hat Enterprise Linux AppStream EUS (v.9.0) java-1.8.0-openjdk-1:1.8.0.392.b08-2.el9_0, java-1.8.0-openjdk-demo-1:1.8.0.392.b08-2.el9_0, java-1.8.0-openjdk-devel-1:1.8.0.392.b08-2.el9_0 +4
- RHSA-2023:5727 Released 2023-10-18 · Red Hat rating Moderatejava-1.8.0-openjdk security update
- Red Hat Enterprise Linux AppStream E4S (v. 8.1) java-1.8.0-openjdk-1:1.8.0.392.b08-2.el8_1, java-1.8.0-openjdk-accessibility-1:1.8.0.392.b08-2.el8_1, java-1.8.0-openjdk-demo-1:1.8.0.392.b08-2.el8_1 +5
- RHSA-2023:5731 Released 2023-10-18 · Red Hat rating Moderatejava-1.8.0-openjdk security update
- Red Hat Enterprise Linux AppStream (v. 8) java-1.8.0-openjdk-1:1.8.0.392.b08-4.el8, java-1.8.0-openjdk-accessibility-1:1.8.0.392.b08-4.el8, java-1.8.0-openjdk-demo-1:1.8.0.392.b08-4.el8 +5
- Red Hat Enterprise Linux CRB (v. 8) java-1.8.0-openjdk-accessibility-fastdebug-1:1.8.0.392.b08-4.el8, java-1.8.0-openjdk-accessibility-slowdebug-1:1.8.0.392.b08-4.el8, java-1.8.0-openjdk-demo-fastdebug-1:1.8.0.392.b08-4.el8 +9
- RHSA-2023:5761 Released 2023-10-18 · Red Hat rating Moderatejava-1.8.0-openjdk security update
- Red Hat Enterprise Linux Client (v. 7) java-1.8.0-openjdk-1:1.8.0.392.b08-2.el7_9, java-1.8.0-openjdk-headless-1:1.8.0.392.b08-2.el7_9
- Red Hat Enterprise Linux Client Optional (v. 7) java-1.8.0-openjdk-accessibility-1:1.8.0.392.b08-2.el7_9, java-1.8.0-openjdk-demo-1:1.8.0.392.b08-2.el7_9, java-1.8.0-openjdk-devel-1:1.8.0.392.b08-2.el7_9 +3
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) java-1.8.0-openjdk-accessibility-1:1.8.0.392.b08-2.el7_9, java-1.8.0-openjdk-demo-1:1.8.0.392.b08-2.el7_9, java-1.8.0-openjdk-devel-1:1.8.0.392.b08-2.el7_9 +3
- Red Hat Enterprise Linux Server (v. 7) java-1.8.0-openjdk-1:1.8.0.392.b08-2.el7_9, java-1.8.0-openjdk-devel-1:1.8.0.392.b08-2.el7_9, java-1.8.0-openjdk-headless-1:1.8.0.392.b08-2.el7_9
- Red Hat Enterprise Linux Server Optional (v. 7) java-1.8.0-openjdk-accessibility-1:1.8.0.392.b08-2.el7_9, java-1.8.0-openjdk-demo-1:1.8.0.392.b08-2.el7_9, java-1.8.0-openjdk-javadoc-1:1.8.0.392.b08-2.el7_9 +2
- Red Hat Enterprise Linux Workstation (v. 7) java-1.8.0-openjdk-1:1.8.0.392.b08-2.el7_9, java-1.8.0-openjdk-devel-1:1.8.0.392.b08-2.el7_9, java-1.8.0-openjdk-headless-1:1.8.0.392.b08-2.el7_9
- Red Hat Enterprise Linux Workstation Optional (v. 7) java-1.8.0-openjdk-accessibility-1:1.8.0.392.b08-2.el7_9, java-1.8.0-openjdk-demo-1:1.8.0.392.b08-2.el7_9, java-1.8.0-openjdk-javadoc-1:1.8.0.392.b08-2.el7_9 +2
- RHSA-2023:5725 Released 2023-10-18 · Red Hat rating ModerateOpenJDK 8u392 Security Update for Portable Linux Builds
- Red Hat Build of OpenJDK 8u392
- RHSA-2023:5726 Released 2023-10-18 · Red Hat rating ModerateOpenJDK 8u392 Windows Security Update
- Red Hat Build of OpenJDK 8u392
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
Oracle Java SE JDK and JRE — oracle.com/security-alerts/cpuoct2023.html
3 records Highest priority Priority LOW 3 LOW
Other records, highest priority first
- TI-2023-08450 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise…Priority LOW 33
- TI-2023-08396 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise…Priority LOW 20
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat build of OpenJDK 1.8 | Affected | No fix yet |
| Red Hat Build of OpenJDK 8u392 | Fixed | RHSA-2023:5725 |
| Red Hat CodeReady Linux Builder EUS (v.8.6) | Fixed | RHSA-2023:5730 |
| Red Hat CodeReady Linux Builder EUS (v.9.0) | Fixed | RHSA-2023:5732 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2023:5731 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2023:5733 |
| Red Hat Enterprise Linux AppStream AUS (v. 8.2) | Fixed | RHSA-2023:5728 |
| Red Hat Enterprise Linux AppStream AUS (v.8.4) | Fixed | RHSA-2023:5729 |
| Red Hat Enterprise Linux AppStream E4S (v. 8.1) | Fixed | RHSA-2023:5727 |
| Red Hat Enterprise Linux AppStream E4S (v. 8.2) | Fixed | RHSA-2023:5728 |
| Red Hat Enterprise Linux AppStream E4S (v.8.4) | Fixed | RHSA-2023:5729 |
| Red Hat Enterprise Linux AppStream EUS (v.8.6) | Fixed | RHSA-2023:5730 |
| Red Hat Enterprise Linux AppStream EUS (v.9.0) | Fixed | RHSA-2023:5732 |
| Red Hat Enterprise Linux AppStream TUS (v. 8.2) | Fixed | RHSA-2023:5728 |
| Red Hat Enterprise Linux AppStream TUS (v.8.4) | Fixed | RHSA-2023:5729 |
| Red Hat Enterprise Linux CRB (v. 8) | Fixed | RHSA-2023:5731 |
| Red Hat Enterprise Linux CRB (v. 9) | Fixed | RHSA-2023:5733 |
| Red Hat Enterprise Linux Client (v. 7) | Fixed | RHSA-2023:5761 |
| Red Hat Enterprise Linux Client Optional (v. 7) | Fixed | RHSA-2023:5761 |
| Red Hat Enterprise Linux Client Supplementary (v. 7) | Fixed | RHSA-2024:0879 |
| Red Hat Enterprise Linux ComputeNode Optional (v. 7) | Fixed | RHSA-2023:5761 |
| Red Hat Enterprise Linux ComputeNode Supplementary (v. 7) | Fixed | RHSA-2024:0879 |
| Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2023:5761 |
| Red Hat Enterprise Linux Server Optional (v. 7) | Fixed | RHSA-2023:5761 |
| Red Hat Enterprise Linux Server Supplementary (v. 7) | Fixed | RHSA-2024:0879 |
| Red Hat Enterprise Linux Supplementary (v. 8) | Fixed | RHSA-2024:0866 |
| Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2023:5761 |
| Red Hat Enterprise Linux Workstation Optional (v. 7) | Fixed | RHSA-2023:5761 |
| Red Hat Enterprise Linux Workstation Supplementary (v. 7) | Fixed | RHSA-2024:0879 |
Not affected: 5 products
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat build of OpenJDK 11
- Red Hat build of OpenJDK 17
Timeline
- 2026-10-02 Threatist record created from CVE-2023-22067
- 2026-10-03 Alias added: GHSA-h8rm-272h-gc9p
- 2026-10-09 Fix available: RHSA-2023:5726 · Red Hat
- 2026-10-09 Affected versions changed · Red Hat
References
More Oracle Jdk vulnerabilities
- TI-2016-02888 Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77… KEVCVSS 3.1CRITICAL 9.8
- TI-2015-02278 Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded… KEVCVSS 3.1CRITICAL 9.8
- TI-2013-00349 Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to… KEVCVSS 3.1CRITICAL 9.8
- TI-2012-03989 Multiple vulnerabilities in the Java Runtime Environment (JRE) component in Oracle Java… KEVCVSS 3.1CRITICAL 9.8
- TI-2012-01511 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java… KEVCVSS 3.1CRITICAL 9.8
- TI-2011-03122 Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK… KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2023-22067 · CVE Program
- CVE-2023-22067 · NVD
- FIRST EPSS
- GHSA-h8rm-272h-gc9p · GitHub Advisory Database · CC BY 4.0
- CVE-2023-22067 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences