CVE-2022-31139

    Dashboard / Vulnerabilities / CVE-2022-31139

    CVE-2022-31139

    Published: 11 Jul 2022Last Modified: 27 Aug 2026

    Summary: No security checking for UnsafeAccess.getInstance() in UnsafeAccessor

    Details: UnsafeAccessor (UA) is a bridge to access jdk.internal.misc.Unsafe & sun.misc.Unsafe. Normally, if UA is loaded as a named module, the internal data of UA is protected by JVM and others can only access UA via UA's standard API. The main application can set up `SecurityCheck.AccessLimiter` for UA to limit access to UA. Starting with version 1.4.0 and prior to version 1.7.0, when `SecurityCheck.AccessLimiter` is set up, untrusted code can access UA without limitation, even when UA is loaded as a named module. This issue does not affect those for whom `SecurityCheck.AccessLimiter` is not set up. Version 1.7.0 contains a patch.

    References: https://github.com/Karlatemp/UnsafeAccessor/releases/tag/1.7.0, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31139.json, https://github.com/Karlatemp/UnsafeAccessor/security/advisories/GHSA-cr6p-23cf-w9g9, https://nvd.nist.gov/vuln/detail/CVE-2022-31139, https://github.com/Karlatemp/UnsafeAccessor/commit/4ef83000184e8f13239a1ea2847ee401d81585fd

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 42a3ec0012ee32af040ec0c83d32ff03b5b72a89
    Fixed -de5d97c6eb5f6af5df929bb02a1ccce3849628fe

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-31139 | CVE-DB