Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle…
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JavaFX). Supported versions that are affected are Oracle Java SE: 8u391; Oracle GraalVM Enterprise Edition: 20.3.12 and 21.3.8. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.1 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N).
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Oracle | Java SE JDK and JRE | Oracle Java SE:8u391; Oracle GraalVM Enterprise Edition:20.3.12; Oracle GraalVM Enterprise Edition:21.3.8 | — | No fix listed | CNA |
| — | org.openjfx:javafx-media (Maven) | before 17.0.10 | 17.0.10 | Patch available | GHSA-47g3-mf24-6559 |
| — | org.openjfx:javafx-media (Maven) | 18 to before 21.0.2 | 21.0.2 | Patch available | GHSA-47g3-mf24-6559 |
- Java SE JDK and JRE VendorOracle Affected Oracle Java SE:8u391; Oracle GraalVM Enterprise Edition:20.3.12; Oracle GraalVM Enterprise Edition:21.3.8 Fixed in — No fix listed CNA
- org.openjfx:javafx-media (Maven) Vendor— Affected before 17.0.10 Fixed in 17.0.10 Patch available GHSA-47g3-mf24-6559
- org.openjfx:javafx-media (Maven) Vendor— Affected 18 to before 21.0.2 Fixed in 21.0.2 Patch available GHSA-47g3-mf24-6559
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:oracle:graalvm:20.3.12:*:*:*:enterprise:*:*:* | 20.3.12 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:graalvm:21.3.8:*:*:*:enterprise:*:*:* | 21.3.8 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:jdk:1.8.0:update391:*:*:-:*:*:* | 1.8.0 update391 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:jre:1.8.0:update391:*:*:-:*:*:* | 1.8.0 update391 | Vulnerable | Oracle |
- cpe:2.3:a:oracle:graalvm:20.3.12:*:*:*:enterprise:*:*:* Versions 20.3.12 Vulnerable ·Oracle
- cpe:2.3:a:oracle:graalvm:21.3.8:*:*:*:enterprise:*:*:* Versions 21.3.8 Vulnerable ·Oracle
- cpe:2.3:a:oracle:jdk:1.8.0:update391:*:*:-:*:*:* Versions 1.8.0 update391 Vulnerable ·Oracle
- cpe:2.3:a:oracle:jre:1.8.0:update391:*:*:-:*:*:* Versions 1.8.0 update391 Vulnerable ·Oracle
Remediation
- Fix · GHSA-47g3-mf24-6559 org.openjfx:javafx-media (Maven) Fixed in 17.0.10 Advisory →
- Fix · GHSA-47g3-mf24-6559 org.openjfx:javafx-media (Maven) Fixed in 21.0.2 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2024-20925
- 2026-10-03 Alias added: GHSA-47g3-mf24-6559
References
Other 7
- https://github.com/openjdk/jfx/commit/0a52a4cf1d1226e7a3c6d73313fde02e7f36fb11
- https://github.com/openjdk/jfx17u/commit/18206453163dec04f36f8787ce73624bb9ba6a7d
- https://github.com/openjdk/jfx21u/commit/0c00753da13ed696b1a5025ce01ff478ee7ebd0a
- https://github.com/openjdk/jfx
- https://github.com/openjdk/jfx/blob/4beeb89f864ccf1424db36c9739a7f6999adeecc/doc-files/release-notes-22.md?plain=1#L122
- https://openjdk.org/groups/vulnerability/advisories/2024-01-16
- https://security.netapp.com/advisory/ntap-20240201-0002
More Oracle Graalvm vulnerabilities
- TI-2023-22374 Improper check for unusual conditions in Apple macOS KEVCVSS 3.1HIGH 8.8
- TI-2022-15084 Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets CVSS 3.1HIGH 7.5
- TI-2020-06291 Prototype pollution in y18n CVSS 3.1CRITICAL 9.8
- TI-2022-05834 Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle… CVSS 3.1HIGH 7.5
- TI-2019-11704 HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed CVSS 3.1CRITICAL 9.8
- TI-2019-06950 Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a… CVSS 3.1HIGH 7.5
Sources
- CVE-2024-20925 · CVE Program
- CVE-2024-20925 · NVD
- FIRST EPSS
- GHSA-47g3-mf24-6559 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences