CVE-2024-21210
Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. Oracle Critical Patch Update Advisory - October 2024: https://www.oracle.com/security-alerts/cpuoct2024.html#AppendixJAVA
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-21210?
CVE-2024-21210 has a high severity rating due to the potential for unauthorized access and data manipulation in Oracle Java SE.
How do I fix CVE-2024-21210?
To fix CVE-2024-21210, update to the latest patched versions of OpenJDK, specifically versions 11.0.26+4-1, 17.0.13+11-2, 21.0.6+7-1, or 23.0.2+7-1 depending on your installation.
What types of access does CVE-2024-21210 allow an attacker?
CVE-2024-21210 allows an attacker to gain unauthorized update, insert, or delete access to some accessible data in Oracle Java SE.
Who is affected by CVE-2024-21210?
CVE-2024-21210 affects users of specific OpenJDK versions, including OpenJDK 8, 11, 17, 21, and 23 that are below the specified patched versions.
Can CVE-2024-21210 be exploited remotely?
Yes, CVE-2024-21210 is exploitable by unauthenticated attackers with network access via multiple protocols.