PT-2020-1458 · Oracle · Java Se+2

Published 2020-01-14 · Updated 2026-05-08 · CVE-2020-2585

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Java SE version 8u231

Description The issue is related to inadequate access control in the JavaFX component of Oracle Java SE, allowing an unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks can result in unauthorized creation, deletion, or modification access to critical data or all Java SE accessible data. This issue applies to Java deployments that load and run untrusted code and rely on the Java sandbox for security. It can also be exploited through APIs in the specified component.

Recommendations For Java SE version 8u231, consider disabling the use of JavaFX component until a patch is available, and restrict access to APIs that supply data to the JavaFX component to minimize the risk of exploitation. Additionally, ensure that only trusted code is run in sandboxed Java Web Start applications or sandboxed Java applets. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2020-00441

BIT-JAVA-2020-2585

BIT-JAVA-MIN-2020-2585

BIT-JRE-2020-2585

CVE-2020-2585

Affected Products

Java Platform

Java Se

Javafx

References · 17

• https://security.gentoo.org/glsa/202209-15 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-2585 · Security Note
• https://security.gentoo.org/glsa/202006-22 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-00441 · Security Note
• https://osv.dev/vulnerability/BIT-java-min-2020-2585 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-2585 · Security Note
• https://osv.dev/vulnerability/CVE-2020-2585 · Vendor Advisory
• https://oracle.com/security-alerts/cpujan2020.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-2585 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-jre-2020-2585 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-2585 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-java-2020-2585 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-2585 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-2585 · Vendor Advisory
• https://security.netapp.com/advisory/ntap-20200122-0003 · Note