CVE-2024-21002: 
Amazon Corretto JDK vulnerability analysis and mitigation

CVE-2024-21002 is a vulnerability in Oracle Java SE's JavaFX component, affecting Oracle Java SE version 8u401 and Oracle GraalVM Enterprise Edition versions 20.3.13 and 21.3.9. This vulnerability is classified as difficult to exploit and requires an unauthenticated attacker with logon access to the infrastructure where the affected software executes, along with human interaction from a person other than the attacker (Oracle CPU).

The vulnerability has been assigned a CVSS 3.1 Base Score of 2.5 (Low severity) with the following vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N. This indicates a local attack vector with high attack complexity, no privileges required, and user interaction required. The scope is unchanged, with no impact on confidentiality, low impact on integrity, and no impact on availability (Oracle CPU, NetApp Advisory).

Successful exploitation of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE and Oracle GraalVM Enterprise Edition accessible data. The vulnerability specifically applies to Java deployments that load and run untrusted code, such as sandboxed Java Web Start applications or sandboxed Java applets, and rely on the Java sandbox for security (Oracle CPU).

The vulnerability is characterized as difficult to exploit and requires specific conditions: the attacker must have logon access to the infrastructure where the affected software runs, and successful exploitation requires human interaction from someone other than the attacker. The vulnerability does not apply to Java deployments that load and run only trusted code, such as those typically found in servers (Oracle CPU).

Oracle has released security patches to address this vulnerability. The fixes are available in the April 2024 Critical Patch Update. Organizations using affected versions of Oracle Java SE (8u401) or Oracle GraalVM Enterprise Edition (20.3.13 and 21.3.9) should apply the latest security updates (Oracle CPU, NetApp Advisory).