CVE-2022-21282

What it actually does

The flaw in the JAXP component permits an unauthenticated network attacker to read a limited subset of data accessible to the Java process by supplying crafted input through APIs or untrusted code loaded in sandboxed environments.

Why it matters to the business

Organizations running affected Java deployments face potential exposure of sensitive information processed by applications that accept external data, increasing compliance and data-breach risks across client-side and server-side Java usage.

How an attack unfolds

An attacker with network reachability supplies malicious XML or related payloads to JAXP processing APIs, either directly via a web service or by delivering untrusted code that the Java sandbox executes, resulting in unauthorized read access to a subset of application data without requiring authentication or user interaction.

How to fix it

Apply the latest available Oracle Java SE and GraalVM updates that address JAXP issues; for downstream products such as NetApp tools and Debian packages, install the corresponding vendor security updates as soon as they become available.

How to confirm the fix worked

Confirm Java and GraalVM versions are upgraded beyond the listed vulnerable releases (7u321, 8u311, 11.0.13, 17.0.1, 20.3.4, 21.3.0) and test that JAXP processing no longer permits unauthorized data reads with crafted inputs.

Typical attack path

1. Identify Java deployments exposing JAXP APIs or running sandboxed applets/Web Start applications
2. Craft and send malicious input via network protocols or untrusted code delivery
3. Trigger JAXP processing to leak a limited subset of accessible data
4. Exfiltrate the disclosed information

How to detect it

Because no public exploitation or ransomware usage is recorded, focus on standard Java application logging for unexpected JAXP parsing errors or data-access anomalies; review web-service and sandbox logs for unusual input patterns.

What your security team should do

• Prioritize patching all Oracle Java SE and GraalVM installations to current versions
• Review and restrict network exposure of any Java services that process untrusted data through JAXP
• Monitor EPSS and threat intelligence feeds for any future increase in exploitation activity