JavaFX Vulnerability in Oracle Java SE and GraalVM Enterprise Edition

CVE-2024-20922

Summary

A vulnerability exists within Oracle Java SE and Oracle GraalVM Enterprise Edition, particularly affecting the JavaFX component. This vulnerability is challenging to exploit, as it requires an unauthenticated attacker to have logon access to the infrastructure where these products operate. Exploitation demands human interaction from an individual other than the attacker, which raises concerns regarding security particularly in environments running sandboxed Java Web Start applications or applets that execute untrusted code. Successful exploitation can lead to unauthorized access where an attacker can perform operations including updating, inserting, or deleting accessible data. Importantly, this vulnerability does not impact server-side Java deployments that load only trusted code, such as those installed by administrators.

References