CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NCVE-2022-29249
High (7.5) in javaez project javaez. EPSS 0.7% chance of exploitation in the next 30 days. Fixed in io.github.javaezlib:JavaEZ 1.7.
JavaEZ is a library that adds new functions to make Java easier. A weakness in JavaEZ 1.6 allows force decryption of locked text by unauthorized actors. The issue is NOT critical for non-secure applications, however may be critical in a situation where the highest levels of security are required. This issue ONLY affects v1.6 and does not affect anything pre-1.6. The vulnerability has been patched in release 1.7. Currently, there is no way to fix the issue without upgrading.
Severity
- EPSS
- 0.7% chance of exploitation in the next 30 days; higher than 54% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-326, CWE-327, CWE-328
- Published
- Modified
- Record from
- the NVD, synced
Affected
- javaez_project:javaez
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-67fj-6w6m-w5j8 | Maven | io.github.javaezlib:JavaEZ | >=1.6 <1.7 | 1.7 |