CVE-2023-52070
HighCVSS 8.4Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
JFreeChart version 1.5.4 was found to be vulnerable to an ArrayIndexOutOfBounds exception via the 'setSeriesNeedle(int index, int type)' method. However, multiple third parties dispute the validity of this finding, suggesting it may have been based on an insufficiently robust vulnerability identification tool.
Risk Assessment
The risk to the organization is uncertain due to the disputed nature of the vulnerability. If valid, it could lead to application crashes when processing malformed input.
Recommendation
Monitor official JFreeChart channels for updates or patches. Consider implementing input validation before passing data to the 'setSeriesNeedle' method as a temporary mitigation.
Other vulnerabilities in JFreeChart
See all- CVE-2024-22949Critical
A NullPointerException was discovered in JFreeChart v1.5.4 via the component /chart/annotations/CategoryLineAnnotation. However, multiple third parties dispute the existence of this vulnerability, suggesting the submission may have been based on a tool that is not sufficiently robust for vulnerability identification.
- CVE-2024-23077High
JFreeChart v1.5.4 was reported to have an ArrayIndexOutOfBounds vulnerability in the /chart/plot/CompassPlot.java component. However, multiple third parties dispute the existence of this vulnerability, suggesting the report may have been based on an insufficiently robust tool.
- CVE-2024-23076High
A potential NullPointerException was reported in JFreeChart version 1.5.4 in the BubbleXYItemLabelGenerator component. However, multiple third parties dispute the existence of this vulnerability, citing insufficient evidence.
Original NVD description (English source)
JFreeChart v1.5.4 was discovered to be vulnerable to ArrayIndexOutOfBounds via the 'setSeriesNeedle(int index, int type)' method. NOTE: this is disputed by multiple third parties who believe there was not reasonable evidence to determine the existence of a vulnerability. The submission may have been based on a tool that is not sufficiently robust for vulnerability identification.