Unauthenticated Network Vulnerability in Oracle Java SE and GraalVM Products

CVE-2024-20918

Summary

A vulnerability in Oracle Java SE and GraalVM products allows unauthenticated attackers with network access to exploit the system through multiple protocols. This flaw primarily affects versions such as Oracle Java SE 8u391, 11.0.21, and GraalVM for JDK 17.0.9. The vulnerability grants the potential for unauthorized creation, deletion, or modification of crucial data, as well as complete access to all data processed by the affected products. Successful exploitation can occur through APIs in the Hotspot component, especially in environments relying on Java for executing untrusted code, such as sandboxed applications. Security measures are recommended to mitigate these risks.

References