The version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is affected by multiple vulnerabilities as referenced in the October 2022 CPU advisory:

  - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JGSS).     Supported versions that are affected are Oracle Java SE: 17.0.4.1, 19; Oracle GraalVM Enterprise Edition: 21.3.3     and 22.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via Kerberos to     compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result     in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition     accessible data. (CVE-2022-21618)

  - VVulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component:     JNDI). Supported versions that are affected are Oracle Java SE: 8u341, 8u345-perf, 11.0.16.1, 17.0.4.1, 19; Oracle     GraalVM Enterprise Edition: 20.3.7, 21.3.3 and 22.2.0. Difficult to exploit vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise     Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to     some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. (CVE-2022-21624)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component:     Security). Supported versions that are affected are Oracle Java SE: 8u341, 8u345-perf, 11.0.16.1; Oracle GraalVM     Enterprise Edition: 20.3.7, 21.3.3 and 22.2.0. Easily exploitable vulnerability allows unauthenticated attacker     with network access via HTTPS to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks     of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of     Oracle Java SE, Oracle GraalVM Enterprise Edition. (CVE-2022-21626)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Oracle Java SE Multiple Vulnerabilities (October 2022 CPU)

medium Nessus Plugin ID 166316

Version 1.6

Version 1.5

Version 1.4

Version 1.3

Version 1.1

Version 1.6 Mar 23, 2023, 4:25 PM CVSS metrics ("CVSSv2 score" changed from "9.4" to "5.0". "CVSSv2 score" changed from "9.4" to "5.0". "CVSSv2 score" changed from "9.4" to "5.0". "CVSSv2 vector" changed from "CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:N" to "CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N". "CVSSv2 vector" changed from "CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:N" to "CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N") CVSSv2 score source (changed from "CVE-2022-21626" to "CVE-2022-21618") CVSSv2 severity (based on CVE-2022-21618, severity decreased from "High" to "Medium") Exploit attributes ("Exploit available" set to "False")
Version 1.5 Jan 19, 2023, 6:11 PM IAVM reference
Version 1.4 Dec 30, 2022, 4:05 PM Required Scan configuration (thorough_tests)
Version 1.3 Oct 21, 2022, 5:04 PM CVSS metrics CVSSv3 score source (Changed from None to CVE-2022-21618) CVSSv3 severity (Based on CVE-2022-21618 severity decreased from High to Medium) CVSS temporal metrics Exploit attributes
Version 1.1 Oct 20, 2022, 4:02 PM New