CVERadar

CVE-2024-20945

Medium Severity

Oracle

SVRS

30/100

CVSSv3

5.1/10

EPSS

0.00049/1

CVE-2024-20945 is a security vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. This flaw could allow a low-privileged attacker with local access to potentially gain unauthorized access to sensitive data. The vulnerability affects multiple versions, including Oracle Java SE versions 8u391, 11.0.21, 17.0.9, and 21.0.1.

Despite a CVSS score of 5.1, SOCRadar's Vulnerability Risk Score (SVRS) indicates a score of 30, suggesting a relatively low level of immediate threat compared to other vulnerabilities. Successful exploitation can lead to unauthorized access to critical or all accessible data. This vulnerability is significant because it impacts widely used Java deployments, including those running sandboxed applets and web start applications. Organizations utilizing affected versions of Oracle Java SE and GraalVM should investigate to determine if remediation steps are needed despite the lower SVRS score. Applying the latest security patches is a crucial step in mitigating the risk.

Indicators of Compromise

No IOCs found for this CVE

Exploits

No exploits found for this CVE

Enhance Your CVE Management with SOCRadar Vulnerability Intelligence

Get comprehensive CVE details, real-time notifications, and proactive threat management all in one platform.

CREATE FREE ACCOUNT

CVE Details

Access comprehensive CVE information instantly

Real-time Tracking

Subscribe to CVEs and get instant updates

Exploit Analysis

Monitor related APT groups and threats

IOC Tracking

Analyze and track CVE-related IOCs

News

CVE-2024-20945 | Oracle Java SE up to 8u391/8u391-perf/11.0.21/17.0.9/21.0.1 Security information disclosure (Nessus ID 208585)

vuldb.com2025-05-07

CVE-2024-20945 | Oracle Java SE up to 8u391/8u391-perf/11.0.21/17.0.9/21.0.1 Security information disclosure (Nessus ID 208585) | A vulnerability classified as critical was found in Oracle Java SE up to 8u391/8u391-perf/11.0.21/17.0.9/21.0.1. This vulnerability affects unknown code of the component Security. The manipulation leads to information disclosure. This vulnerability was named CVE-2024-20945. An attack has to be approached locally. There is no exploit available.

vuldb.com

rss

forum

news

USN-7096-2: OpenJDK 8 regressions

2025-02-05

USN-7096-2: OpenJDK 8 regressions | USN-7096-1 fixed vulnerabilities in OpenJDK 8. The update introduced several minor regressions. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Andy Boothe discovered that the Networking component of OpenJDK 8 did not properly handle access under certain circumstances. An unauthenticated attacker could possibly use this issue to cause a denial of service. (CVE-2024-21208) It was discovered that the Hotspot component of OpenJDK 8 did not properly handle vectorization under certain circumstances. An unauthenticated attacker could possibly use this issue to access unauthorized resources and expose

ubuntu.com

rss

forum

news

USN-7096-1: OpenJDK 8 vulnerabilities

2024-11-11

USN-7096-1: OpenJDK 8 vulnerabilities | Andy Boothe discovered that the Networking component of OpenJDK 8 did not properly handle access under certain circumstances. An unauthenticated attacker could possibly use this issue to cause a denial of service. (CVE-2024-21208) It was discovered that the Hotspot component of OpenJDK 8 did not properly handle vectorization under certain circumstances. An unauthenticated attacker could possibly use this issue to access unauthorized resources and expose sensitive information. (CVE-2024-21210, CVE-2024-21235) It was discovered that the Serialization component of OpenJDK 8 did not properly handle deserialization under certain circumstances. An

ubuntu.com

rss

forum

news

Social Media

No tweets found for this CVE

Affected Software

Configuration 1

Type	Vendor	Product
App	Oracle	graalvm
App	Oracle	graalvm_for_jdk
App	Oracle	jdk
App	Oracle	jre

References

Reference	Link
[email protected]	https://www.oracle.com/security-alerts/cpujan2024.html
AF854A3A-2127-422B-91AE-364DA2661108	https://www.oracle.com/security-alerts/cpujan2024.html
[email protected]	https://www.oracle.com/security-alerts/cpujan2024.html

CWE Details

No CWE details found for this CVE

CVE Radar

Real-time CVE Intelligence & Vulnerability Management Platform

CVE Radar provides comprehensive vulnerability intelligence by monitoring CVE databases, security advisories, and threat feeds. Get instant updates on new vulnerabilities, exploit details, and mitigation strategies specific to your assets.

Get Free Vulnerability Intelligence AccessAccess real-time CVE monitoring, exploit analysis, and threat intelligence