PT-2020-3575 · Oracle+5 · Oracle Java Se+6
Published
2020-07-14
·
Updated
2026-05-08
·
CVE-2020-14573
CVSS v2.0
4.3
Medium
| Vector | AV:N/AC:M/Au:N/C:N/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
Oracle Java SE versions 11.0.7 and 14.0.1
Description
The issue is related to insufficient input validation in the Hotspot component of Oracle Java SE. It allows an unauthenticated attacker with network access via multiple protocols to compromise Java SE, resulting in unauthorized update, insert, or delete access to some of Java SE's accessible data. This can be exploited through sandboxed Java Web Start applications, sandboxed Java applets, or by supplying data to APIs in the specified component without using sandboxed applications or applets. The vulnerability can be exploited using the HTTP protocol.
Recommendations
For Oracle Java SE version 11.0.7, update to a version that includes the fix for this issue.
For Oracle Java SE version 14.0.1, update to a version that includes the fix for this issue.
As a temporary workaround, consider restricting access to the Hotspot component until a patch is available.
Avoid using the vulnerable APIs in the Hotspot component to minimize the risk of exploitation.
Fix
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Centos
Java Platform
Linuxmint
Oracle Java Se
Red Hat
Suse
Ubuntu