Improper input validation in Oracle GraalVM Enterprise Edition - CVE-2024-21005

Vulnerability identifier: #VU88671

CSH Severity: Low

CVSS v4 BT: 0.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-21005

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote non-authenticated attacker to manipulate data.

The vulnerability exists due to improper input validation within the JavaFX component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to manipulate data.

Oracle GraalVM Enterprise Edition
Amazon Linux AMI
F5OS
openEuler
Oracle Java SE
NetWorker Runtime Environment (NRE)
IBM Cloud Pak for Watson AIOps
Storage Resource Manager
Dell EMC Storage Monitoring and Reporting (SMR)
EMC Data Protection Advisor
java-latest-openjdk-devel
java-latest-openjdk-slowdebug
java-latest-openjdk-jmods-slowdebug
java-latest-openjdk-jmods
java-latest-openjdk-javadoc-zip
java-latest-openjdk-javadoc
java-latest-openjdk-headless-slowdebug
java-latest-openjdk-headless
java-latest-openjdk-devel-slowdebug
java-latest-openjdk-src
java-latest-openjdk-demo-slowdebug
java-latest-openjdk-demo
java-latest-openjdk
java-latest-openjdk-src-slowdebug

Install updates from vendor's website.

NetWorker Runtime Environment (NRE) - update to 8.0.21
IBM Cloud Pak for Watson AIOps - update to 4.8.1
Storage Resource Manager - update to 5.0.1.0
Dell EMC Storage Monitoring and Reporting (SMR) - update to 5.0.1.0
EMC Data Protection Advisor - update to 19.10 B46
java-latest-openjdk-devel - update to 23.0.1.11-1
java-latest-openjdk-slowdebug - update to 23.0.1.11-1
java-latest-openjdk-jmods-slowdebug - update to 23.0.1.11-1
java-latest-openjdk-jmods - update to 23.0.1.11-1
java-latest-openjdk-javadoc-zip - update to 23.0.1.11-1
java-latest-openjdk-javadoc - update to 23.0.1.11-1
java-latest-openjdk-headless-slowdebug - update to 23.0.1.11-1
java-latest-openjdk-headless - update to 23.0.1.11-1
java-latest-openjdk-devel-slowdebug - update to 23.0.1.11-1
java-latest-openjdk-src - update to 23.0.1.11-1
java-latest-openjdk-demo-slowdebug - update to 23.0.1.11-1
java-latest-openjdk-demo - update to 23.0.1.11-1
java-latest-openjdk - update to 23.0.1.11-1
java-latest-openjdk-src-slowdebug - update to 23.0.1.11-1

• https://www.oracle.com/security-alerts/cpuapr2024.html

• Multiple vulnerabilities in Oracle GraalVM Enterprise Edition
• Multiple vulnerabilities in Oracle Java SE
• Multiple vulnerabilities in F5OS
• Multiple vulnerabilities in Dell NetWorker Runtime Environment (NRE)
• Multiple vulnerabilities in Dell Storage Resource Manager (SRM) and Dell Storage Monitoring and Reporting (SMR)
• Multiple vulnerabilities in Data Protection Advisor
• Amazon Linux AMI update for java-1.8.0-amazon-corretto
• openEuler 22.03 LTS SP4 update for openjdk-latest
• openEuler 24.03 LTS update for openjdk-latest
• openEuler 22.03 LTS SP1 update for openjdk-latest
• openEuler 20.03 LTS SP4 update for openjdk-latest
• openEuler 22.03 LTS SP3 update for openjdk-latest
• Multiple vulnerabilities in IBM Cloud Pak for AIOps