PT-2023-3965 · Oracle+1 · Oracle Java Se+3

Published 2023-07-18 · Updated 2026-05-08 · CVE-2023-22043

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Oracle Java SE version 8u371

Description The issue is related to a vulnerability in the JavaFX component of Oracle Java SE, allowing an unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks can result in unauthorized creation, deletion, or modification access to critical data or all Oracle Java SE accessible data. This vulnerability applies to Java deployments that load and run untrusted code, such as sandboxed Java Web Start applications or sandboxed Java applets, and rely on the Java sandbox for security.

Recommendations For Oracle Java SE version 8u371, consider disabling the JavaFX component until a patch is available. Restrict access to untrusted code, such as code from the internet, to minimize the risk of exploitation. Avoid using sandboxed Java Web Start applications or sandboxed Java applets that load and run untrusted code until the issue is resolved.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2023-04260

BIT-JAVA-2023-22043

BIT-JAVA-MIN-2023-22043

BIT-JRE-2023-22043

CVE-2023-22043

ROSA-SA-2023-2312

Affected Products

Java Platform

Javafx

Oracle Java Se

Red Os

References · 26

• https://osv.dev/vulnerability/BIT-jre-2023-22043 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-22043 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-22043 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-22043 · Vendor Advisory
• https://oracle.com/security-alerts/cpujul2023.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-04260 · Security Note
• https://osv.dev/vulnerability/BIT-java-2023-22043 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-22043 · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-22043 · Security Note
• https://osv.dev/vulnerability/CVE-2023-22043 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-22043 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-java-min-2023-22043 · Vendor Advisory
• https://security.netapp.com/advisory/ntap-20230725-0006 · Note
• https://t.me/cvenotify/55096 · Telegram Post