Improper input validation in Oracle GraalVM Enterprise Edition - CVE-2024-21002

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU88672

Improper input validation in Oracle GraalVM Enterprise Edition - CVE-2024-21002

Published: April 17, 2024


Vulnerability identifier: #VU88672
CSH Severity: Low
CVSS v4 BT: 0.2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2024-21002
CWE-ID: CWE-20
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local non-authenticated attacker to manipulate data.

The vulnerability exists due to improper input validation within the JavaFX component in Oracle GraalVM Enterprise Edition. A local non-authenticated attacker can exploit this vulnerability to manipulate data.


Affected software

Oracle GraalVM Enterprise Edition
Amazon Linux AMI
openEuler
Oracle Java SE
NetWorker Runtime Environment (NRE)
Storage Resource Manager
Dell EMC Storage Monitoring and Reporting (SMR)
EMC Data Protection Advisor
java-latest-openjdk-jmods
java-latest-openjdk-javadoc
java-latest-openjdk-javadoc-zip
java-latest-openjdk-headless-slowdebug
java-latest-openjdk-headless
java-latest-openjdk-devel-slowdebug
java-latest-openjdk-devel
java-latest-openjdk-demo-slowdebug
java-latest-openjdk-demo
java-latest-openjdk
java-latest-openjdk-src-slowdebug
java-latest-openjdk-src
java-latest-openjdk-slowdebug
java-latest-openjdk-jmods-slowdebug

How to mitigate CVE-2024-21002

Install updates from vendor's website.

NetWorker Runtime Environment (NRE) - update to 8.0.21
Storage Resource Manager - update to 5.0.1.0
Dell EMC Storage Monitoring and Reporting (SMR) - update to 5.0.1.0
EMC Data Protection Advisor - update to 19.10 B46
java-latest-openjdk-jmods - update to 23.0.1.11-1
java-latest-openjdk-javadoc - update to 23.0.1.11-1
java-latest-openjdk-javadoc-zip - update to 23.0.1.11-1
java-latest-openjdk-headless-slowdebug - update to 23.0.1.11-1
java-latest-openjdk-headless - update to 23.0.1.11-1
java-latest-openjdk-devel-slowdebug - update to 23.0.1.11-1
java-latest-openjdk-devel - update to 23.0.1.11-1
java-latest-openjdk-demo-slowdebug - update to 23.0.1.11-1
java-latest-openjdk-demo - update to 23.0.1.11-1
java-latest-openjdk - update to 23.0.1.11-1
java-latest-openjdk-src-slowdebug - update to 23.0.1.11-1
java-latest-openjdk-src - update to 23.0.1.11-1
java-latest-openjdk-slowdebug - update to 23.0.1.11-1
java-latest-openjdk-jmods-slowdebug - update to 23.0.1.11-1

External References

Related Security Bulletins