EXPOSURES › CVE-2015-4902

CVE-2015-4902

HIGH ⌖ ON CISA KEV · EXPLOITED

DETAIL

SourceCISA-KEV · kev Published2022-03-03 Referencehttps://nvd.nist.gov/vuln/detail/CVE-2015-4902 ↗

⌖ EXPLOITED IN THE WILD SHAME 78/100 exploited-in-wildunpatched

Oracle Java SE suffered an integrity vulnerability that was actively exploited in the wild, highlighting the severe risks of unpatched legacy software.

An unspecified integrity vulnerability in Oracle Java SE allowed remote attackers to affect system integrity through unknown deployment vectors. This failure is critical for DIB organizations because unpatched Java environments are a common entry point for ransomware and data breaches, directly impacting CMMC/NIST 800-171 compliance by failing to mitigate known, actively exploited threats. Organizations must rigorously patch all Java SE instances and monitor KEV catalogs to prevent similar exposures.

Shame score — The vulnerability was actively exploited in the wild (KEV), indicating a failure to patch a known, high-severity flaw that attackers were already leveraging against systems.

▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.

PLAYERS IMPLICATED

Oracle · vendor Java SE · product

DESCRIPTION

Unspecified vulnerability in Oracle Java SE allows remote attackers to affect integrity via Unknown vectors related to deployment.

SENTIMENT · TRUSTED SOURCES

synthesis severe-fallout -0.60

Oracle faced severe fallout from a major cloud breach affecting millions of records, though the CVE itself was an unspecified integrity vulnerability; press coverage focused on the breach's scale and

dailysecurityreview.com ↗ severe-fallout -0.80

severe-fallout

"A massive Oracle Cloud breach exposed 6 million records, impacting 140,000 businesses. The attacker, known as rose87168, is actively selling the stolen data online."

dailysecurityreview.com ↗ severe-fallout -0.70

negative

"Oracle denies a major cloud breach, confirming instead a hack of obsolete servers. No Oracle Cloud customer data was compromised, the company claims."

cooey ↗ severe-fallout +0.00

neutral

"Unspecified vulnerability in Oracle Java SE allows remote attackers to affect integrity via Unknown vectors related to deployment."

www.cvefind.com ↗ severe-fallout +0.00

neutral

"CVE, short for Common Vulnerabilities and Exposures, is a list of publicly disclosed computer security flaws."

www.cbsnews.com ↗ severe-fallout +0.00

neutral

"Cybercriminal group claims it stole FBI personnel and applicant data"

app.opencve.io ↗ severe-fallout +0.00

neutral

"CVEs and Security Vulnerabilities - OpenCVE"

AFFECTED FEDRAMP PRODUCTS · 10

PRODUCT	PROVIDER	STATUS	MATCH
Aconex for Defense Oracle	Oracle	Authorized	vendor-exact · 0.90
Federal Managed Cloud Services Oracle	Oracle	Authorized	vendor-exact · 0.90
Fusion Cloud Oracle	Oracle	Authorized	vendor-exact · 0.90
Government Cloud - Common Controls Oracle	Oracle	Authorized	vendor-exact · 0.90
Oracle Cloud Infrastructure-Government Cloud Oracle	Oracle	Authorized	vendor-exact · 0.90
Oracle Enterprise Performance Management (EPM) Oracle	Oracle	Authorized	vendor-exact · 0.90
Oracle Enterprise Performance Management (EPM) - Moderate Oracle	Oracle	In Process	vendor-exact · 0.90
Oracle Service Cloud Oracle	Oracle	Authorized	vendor-exact · 0.90
Oracle Service Cloud (DOD) Oracle	Oracle	Authorized	vendor-exact · 0.90
Taleo Cloud - U.S. Government Cloud Oracle	Oracle	Authorized	vendor-exact · 0.90