3.7

CVE-2024-21208

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking).  Supported versions that are affected are Oracle Java SE: 8u421, 8u421-perf, 11.0.24, 17.0.12, 21.0.4, 23; Oracle GraalVM for JDK: 17.0.12, 21.0.4, 23; Oracle GraalVM Enterprise Edition: 20.3.15 and  21.3.11. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.7 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).

Verknüpft mit AI von unstrukturierten Daten zu bestehenden CPE der NVD
This information is available to logged-in users.
Data is provided by the National Vulnerability Database (NVD)
Oracle ≫ Graalvm Version20.3.15 SwEditionenterprise
Oracle ≫ Graalvm Version21.3.11 SwEditionenterprise
Oracle ≫ Graalvm For Jdk Version17.0.12
Oracle ≫ Graalvm For Jdk Version21.0.4
Oracle ≫ Graalvm For Jdk Version23
Oracle ≫ Jdk Version1.8.0 Updateupdate421 SwEdition-
Oracle ≫ Jdk Version1.8.0 Updateupdate421 SwEditionenterprise_performance_pack
Oracle ≫ Jdk Version11.0.24
Oracle ≫ Jdk Version17.0.12
Oracle ≫ Jdk Version21.0.4
Oracle ≫ Jdk Version23
Oracle ≫ Jre Version1.8.0 Updateupdate421 SwEdition-
Oracle ≫ Jre Version1.8.0 Updateupdate421 SwEditionenterprise_performance_pack
Oracle ≫ Jre Version11.0.24
Oracle ≫ Jre Version17.0.12
Oracle ≫ Jre Version21.0.4
Oracle ≫ Jre Version23
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.26% 0.498
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
secalert_us@oracle.com 3.7 2.2 1.4
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE-203 Observable Discrepancy

The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.