5.3

CVE-2023-22067: netapp cloud_insights_acquisition_unit Incorrect Authorization

CVSS: 5.3v3.1MediumModified
AliasesUBUNTU-CVE-2023-22067CGA-554h-h837-ppf9CGA-gpw8-xmp8-6862
Published 17-10-2023Last modified 03-11-2025
Open JSON

Vulnerability summary

CVE-2023-22067 is a medium (CVSS 5.3) Incorrect Authorization vulnerability in netapp cloud_insights_acquisition_unit. EPSS estimates a 1.05% chance of exploitation in the next 30 days, higher than 63.7% of scored vulnerabilities.

Overall risk
21/100
0100
Low · default modelHow is this calculated?
CVSS score
5.3/10
010
Medium · v3.1 (CVE.org)
EPSS score
1.05%
0%100%
Low · +0.16 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 19 · Related 12
MGASA-2023-0326OPENSUSE-SU-2024:13421-1OPENSUSE-SU-2024:13457-1RHSA-2023:5727RHSA-2023:5728RHSA-2023:5729

Timeline

  1. 17-10-2023
    PublishedVulnerability first disclosed.
  2. 03-11-2025
    Last modifiedVulnerability information updated.

Description

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: CORBA). Supported versions that are affected are Oracle Java SE: 8u381, 8u381-perf; Oracle GraalVM Enterprise Edition: 20.3.11 and 21.3.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via CORBA to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

1.05%

Chance of exploitation in the next 30 days

Percentile

64%

Versus all other CVEs

30-day change

+0.16 pp

From 0.89% on 18-09-2026

18-09-202618-10-2026
EPSS score
1.05%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard17 products
  • openjdk-11-openj9-default-policy< 0.53.0-r0
  • openjdk-17-openj9-default-policy< 0.53.0-r0
  • openjdk-21-openj9-default-policy< 0.48.0-r2
  • openjdk-25-openj9< 0.59.0-r1
  • openjdk-25-openj9-dbg< 0.59.0-r1
Ubuntu5 products
  • openjdk-13All versions (No fix recorded)
  • openjdk-16All versions (No fix recorded)
  • openjdk-18All versions (No fix recorded)
  • openjdk-8< 8u392-ga-1~16.04 | < 8u392-ga-1~18.04 | < 8u392-ga-1~20.04 | < 8u392-ga-1~22.04
  • openjdk-9All versions (No fix recorded)
Netapp2 products
Oracle2 products
  • jdk1.8.0:update381
  • jre1.8.0:update381
Oracle corporation1 product
  • java se jdk and jreOracle Java SE:8u381 | Oracle Java SE:8u381-perf | Oracle GraalVM Enterprise Edition:20.3.11 | Oracle GraalVM Enterprise Edition:21.3.7
Wolfi1 product
  • openjdk-7All versions (No fix recorded)

6 vendors · 28 products

References

8 links