Summary
The default Java security properties configuration did not restrict access to the com.sun.org.glassfish.external and com.sun.org.glassfish.gmbal packages. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions.
- Vendor
- Oracle
- Product
- Java SE
- Added to KEV
- Mar 28, 2022
- Remediation due
- Apr 18, 2022 (US federal deadline)
- Ransomware use
- Not known
- EPSS
- 91.2% as of Nov 12
In the news
- No Asia-Pacific article names this CVE yet.
Linked
Actors named alongside it:
none
Incidents exploiting it:
- none recorded
References