CVE-2023-21930 is a high-severity vulnerability affecting Oracle Java SE and Oracle GraalVM Enterprise Edition products. An unauthenticated attacker with network access via TLS can exploit this vulnerability to gain unauthorized access to critical data or even complete access to all accessible data. The vulnerability primarily impacts Java deployments, such as clients running sandboxed Java Web Start applications or sandboxed Java applets that load and run untrusted code. It can also be exploited through APIs in the specified components, like web services supplying data to the APIs.

How do I know if I'm affected?

If you're using Oracle Java SE or Oracle GraalVM Enterprise Edition, you might be affected by the CVE-2023-21930 vulnerability. The affected software versions include Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; and Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5, 22.3.1. If you're using any of these versions, it's essential to stay informed and take necessary precautions to protect your data.

What should I do if I'm affected?

If you're affected by the CVE-2023-21930 vulnerability, it's crucial to take action to protect your data. First, check if your software is up-to-date. If not, upgrade your Oracle Java SE or Oracle GraalVM Enterprise Edition to the latest version. For additional support, consult the vendor's advisory or contact their technical support team.

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2023-21930 vulnerability is indeed listed in CISA's Known Exploited Vulnerabilities Catalog. It was added on April 18, 2023. However, the vulnerability name, due date, and required action are not explicitly mentioned. In simple terms, this vulnerability affects Oracle Java SE and Oracle GraalVM Enterprise Edition products, and if exploited, it can lead to unauthorized access to critical data or even complete access to all accessible data. It's essential to stay informed and take necessary precautions to protect your data.

Weakness enumeration

The weakness enumeration for CVE-2023-21930 is "Insufficient Information" (CWE-ID NVD-CWE-noinfo).

For more details

For a comprehensive understanding of the vulnerability, including its description, severity, technical details, and known affected software configurations, refer to the NVD page or the sources listed below.

• NVD - CVE-2023-21930

• Debian LTS Advisory

• NetApp Product Security

• Debian Security Advisory (DSA)