Improper input validation in Oracle Java SE - CVE-2023-22043

Vulnerability identifier: #VU78409

CSH Severity: Medium

CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-22043

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote non-authenticated attacker to manipulate data.

The vulnerability exists due to improper input validation within the JavaFX component in Oracle Java SE. A remote non-authenticated attacker can exploit this vulnerability to manipulate data.

Oracle Java SE
Amazon Linux AMI
Oracle Solaris
IBM Spectrum Copy Data Management
IBM Cloud Object Storage Systems
IBM Sterling Partner Engagement Manager
Oracle Commerce Guided Search
EMC ViPR SRM
Dell EMC Storage Monitoring and Reporting (SMR)

Install updates from vendor's website.

IBM Spectrum Copy Data Management - update to 2.2.21.0
IBM Cloud Object Storage Systems - addressed in versions 3.17.0.121, 3.17.5.79
EMC ViPR SRM - update to 4.10.0.0
Dell EMC Storage Monitoring and Reporting (SMR) - update to 4.10.0.0
IBM Sterling Partner Engagement Manager - addressed in versions 6.1.2.9, 6.2.0.7, 6.2.2.2

• https://www.oracle.com/security-alerts/cpujul2023.html

• Multiple vulnerabilities in Oracle Java SE
• Amazon Linux AMI update for java-1.8.0-openjdk
• Multiple vulnerabilities in Oracle Solaris third-party software
• Multiple vulnerabilities in IBM Spectrum Copy Data Management
• Multiple vulnerabilities in IBM Cloud Object System
• Multiple vulnerabilities in Oracle Commerce Guided Search
• Improper input validation in IBM Sterling Partner Engagement Manager
• Amazon Linux AMI update for java-17-amazon-corretto
• Amazon Linux AMI update for java-11-amazon-corretto
• Amazon Linux AMI update for java-1.8.0-amazon-corretto
• Multiple vulnerabilities in Dell EMC SRM and Dell EMC Storage Monitoring and Reporting (SMR)