PT-2024-3736 · Oracle · Oracle Java Se+3

Published 2024-04-16 · Updated 2026-05-08 · CVE-2024-21005

Positive Technologies (AI Summary)

CVSS v3.1

3.1

Low

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Oracle Java SE version 8u401 Oracle GraalVM Enterprise Edition versions 20.3.13 and 21.3.9

Description: The issue allows an unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE and Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker and can result in unauthorized update, insert, or delete access to some accessible data. This issue applies to Java deployments in clients running sandboxed Java Web Start applications or sandboxed Java applets that load and run untrusted code and rely on the Java sandbox for security.

Recommendations: For Oracle Java SE version 8u401, update to a version that includes the fix for this issue. For Oracle GraalVM Enterprise Edition version 20.3.13, update to a version that includes the fix for this issue. For Oracle GraalVM Enterprise Edition version 21.3.9, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting the use of JavaFX in Oracle Java SE and Oracle GraalVM Enterprise Edition until a patch is available.

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

BDU:2024-04082

BIT-JAVA-2024-21005

BIT-JAVA-MIN-2024-21005

BIT-JRE-2024-21005

CVE-2024-21005

OESA-2024-2485

OESA-2024-2486

OESA-2024-2487

OESA-2024-2488

OESA-2024-2489

OPENSUSE-SU-2024:13919-1

Affected Products

Java Platform

Javafx

Oracle Graalvm Enterprise Edition

Oracle Java Se

References · 71

• https://nvd.nist.gov/vuln/detail/CVE-2024-21217 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-20923 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-20919 · Security Note
• https://cve.org/CVERecord?id=CVE-2024-21005 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-20918 · Security Note
• https://osv.dev/vulnerability/OESA-2024-2486 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-04082 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-20926 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-21140 · Security Note
• https://osv.dev/vulnerability/OESA-2024-2489 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-21012 · Security Note
• https://osv.dev/vulnerability/OESA-2024-2485 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-14578 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-21145 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-21147 · Security Note