Skip to content
CVE PROGRAM SOURCE RECORD3.7 Low

CVE-2024-20954

Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Compiler). Supported versions that are affected are Oracle Gra

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
oracle

Description

Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Compiler). Supported versions that are affected are Oracle GraalVM for JDK: 17.0.10, 21.0.2, 22; Oracle GraalVM Enterprise Edition: 20.3.13 and 21.3.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Oracle Corporation GraalVM

  • Oracle GraalVM for JDK:17.0.10affected
  • Oracle GraalVM for JDK:21.0.2affected
  • Oracle GraalVM for JDK:22affected
  • Oracle GraalVM Enterprise Edition:20.3.13affected
  • Oracle GraalVM Enterprise Edition:21.3.9affected

References