Search for vulnerabilities
Vulnerability details: VCID-f31d-srxs-aaad
Vulnerability ID VCID-f31d-srxs-aaad
Aliases CVE-2024-21094
Summary Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u401, 8u401-perf, 11.0.22, 17.0.10, 21.0.2, 22; Oracle GraalVM for JDK: 17.0.10, 21.0.2, 22; Oracle GraalVM Enterprise Edition: 20.3.13 and 21.3.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).
Status Published
Exploitability 0.5
Weighted Severity 3.3
Risk 1.6
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-787 Out-of-bounds Write
System Score Found at
cvssv3 3.7 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-21094.json
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
epss 0.00052 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
epss 0.00052 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
epss 0.00052 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
epss 0.00052 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
epss 0.00052 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
epss 0.00052 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
epss 0.00052 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
epss 0.00052 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
epss 0.00052 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
epss 0.00052 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
epss 0.00052 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
epss 0.00052 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
epss 0.00056 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
epss 0.00056 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
epss 0.00056 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
epss 0.00056 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
epss 0.00056 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
epss 0.00056 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
epss 0.00056 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
epss 0.00056 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
epss 0.00056 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
epss 0.00056 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
epss 0.00056 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
epss 0.00056 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
epss 0.00056 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
epss 0.00056 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
epss 0.00056 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
epss 0.00056 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
epss 0.00056 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
epss 0.00074 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
epss 0.00074 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
epss 0.00074 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
epss 0.00074 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
epss 0.00074 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
epss 0.00074 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
epss 0.00074 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
epss 0.00074 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
epss 0.00074 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
epss 0.00074 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
epss 0.00074 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
epss 0.00074 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
epss 0.00074 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
epss 0.00074 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
epss 0.00074 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
epss 0.00074 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
epss 0.00074 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
epss 0.00083 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
epss 0.00083 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
epss 0.00083 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
epss 0.00091 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
epss 0.00091 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
epss 0.00091 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
epss 0.00091 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
epss 0.00091 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
epss 0.00091 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
epss 0.00091 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
epss 0.00091 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
epss 0.00091 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
epss 0.00091 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
epss 0.00091 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
epss 0.00091 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
epss 0.00091 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
epss 0.00091 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
epss 0.00091 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
epss 0.00226 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
epss 0.00307 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
epss 0.00307 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
epss 0.00307 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
epss 0.00307 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
epss 0.00307 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
epss 0.00307 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
epss 0.00307 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
epss 0.00307 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
epss 0.00307 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
epss 0.00307 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
epss 0.00307 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
epss 0.00307 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
epss 0.00307 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
epss 0.00307 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
epss 0.00307 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
epss 0.00307 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
epss 0.00307 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
epss 0.00307 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
epss 0.00307 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
epss 0.00307 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
epss 0.00311 https://api.first.org/data/v1/epss?cve=CVE-2024-21094
cvssv3.1 3.7 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3 3.7 https://nvd.nist.gov/vuln/detail/CVE-2024-21094
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-21094.json
https://api.first.org/data/v1/epss?cve=CVE-2024-21094
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21011
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21012
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21068
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21085
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21094
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://lists.debian.org/debian-lts-announce/2024/04/msg00014.html
https://security.netapp.com/advisory/ntap-20240426-0004/
https://www.oracle.com/security-alerts/cpuapr2024.html
1069678 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1069678
2275005 https://bugzilla.redhat.com/show_bug.cgi?id=2275005
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*
cpe:2.3:a:netapp:data_infrastructure_insights_acquisition_unit:-:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:netapp:data_infrastructure_insights_acquisition_unit:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:data_infrastructure_insights_storage_workload_security_agent:-:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:netapp:data_infrastructure_insights_storage_workload_security_agent:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*
cpe:2.3:a:oracle:graalvm:20.3.13:*:*:*:enterprise:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:graalvm:20.3.13:*:*:*:enterprise:*:*:*
cpe:2.3:a:oracle:graalvm:21.3.9:*:*:*:enterprise:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:graalvm:21.3.9:*:*:*:enterprise:*:*:*
cpe:2.3:a:oracle:graalvm_for_jdk:17.0.10:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:graalvm_for_jdk:17.0.10:*:*:*:*:*:*:*
cpe:2.3:a:oracle:graalvm_for_jdk:21.0.2:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:graalvm_for_jdk:21.0.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:graalvm_for_jdk:22:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:graalvm_for_jdk:22:*:*:*:*:*:*:*
cpe:2.3:a:oracle:java_se:11.0.22:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:java_se:11.0.22:*:*:*:*:*:*:*
cpe:2.3:a:oracle:java_se:17.0.10:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:java_se:17.0.10:*:*:*:*:*:*:*
cpe:2.3:a:oracle:java_se:21.0.2:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:java_se:21.0.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:java_se:22:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:java_se:22:*:*:*:*:*:*:*
cpe:2.3:a:oracle:java_se:8u401:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:java_se:8u401:*:*:*:*:*:*:*
cpe:2.3:a:oracle:java_se:8u401:*:*:*:enterprise_performance:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:java_se:8u401:*:*:*:enterprise_performance:*:*:*
cpe:2.3:a:oracle:jdk:11.0.22:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:jdk:11.0.22:*:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:17.0.10:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:jdk:17.0.10:*:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.8.0:update401:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:jdk:1.8.0:update401:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:21.0.2:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:jdk:21.0.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:22.0.1:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:jdk:22.0.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:11.0.22:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:jre:11.0.22:*:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:17.0.10:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:jre:17.0.10:*:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.8.0:update401:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:jre:1.8.0:update401:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:21.0.2:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:jre:21.0.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:22.0.1:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:jre:22.0.1:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
CVE-2024-21094 https://nvd.nist.gov/vuln/detail/CVE-2024-21094
RHSA-2024:1815 https://access.redhat.com/errata/RHSA-2024:1815
RHSA-2024:1816 https://access.redhat.com/errata/RHSA-2024:1816
RHSA-2024:1817 https://access.redhat.com/errata/RHSA-2024:1817
RHSA-2024:1818 https://access.redhat.com/errata/RHSA-2024:1818
RHSA-2024:1819 https://access.redhat.com/errata/RHSA-2024:1819
RHSA-2024:1820 https://access.redhat.com/errata/RHSA-2024:1820
RHSA-2024:1821 https://access.redhat.com/errata/RHSA-2024:1821
RHSA-2024:1822 https://access.redhat.com/errata/RHSA-2024:1822
RHSA-2024:1823 https://access.redhat.com/errata/RHSA-2024:1823
RHSA-2024:1824 https://access.redhat.com/errata/RHSA-2024:1824
RHSA-2024:1825 https://access.redhat.com/errata/RHSA-2024:1825
RHSA-2024:1826 https://access.redhat.com/errata/RHSA-2024:1826
USN-6810-1 https://usn.ubuntu.com/6810-1/
USN-6811-1 https://usn.ubuntu.com/6811-1/
USN-6812-1 https://usn.ubuntu.com/6812-1/
USN-6813-1 https://usn.ubuntu.com/6813-1/
USN-7096-1 https://usn.ubuntu.com/7096-1/
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-21094.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2024-21094
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.17350
EPSS Score 0.00045
Published At Dec. 17, 2024, midnight
Date Actor Action Source VulnerableCode Version
2024-04-23T17:18:20.990442+00:00 NVD Importer Import https://nvd.nist.gov/vuln/detail/CVE-2024-21094 34.0.0rc4