CVE-2024-22949
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk47th percentile - higher than 47% of all known CVEs
Summary
A NullPointerException was discovered in JFreeChart v1.5.4 via the component /chart/annotations/CategoryLineAnnotation. However, multiple third parties dispute the existence of this vulnerability, suggesting the submission may have been based on a tool that is not sufficiently robust for vulnerability identification.
Risk Assessment
The risk to the organization is uncertain due to the disputed nature of the vulnerability. If it exists, it could cause application crashes, but there is no evidence of a real security threat.
Recommendation
It is recommended to monitor official JFreeChart updates and verify the report with the security team. In the meantime, consider implementing temporary mitigations such as input validation.
Other vulnerabilities in JFreeChart
See all- CVE-2024-23077High
JFreeChart v1.5.4 was reported to have an ArrayIndexOutOfBounds vulnerability in the /chart/plot/CompassPlot.java component. However, multiple third parties dispute the existence of this vulnerability, suggesting the report may have been based on an insufficiently robust tool.
- CVE-2023-52070High
JFreeChart version 1.5.4 was found to be vulnerable to an ArrayIndexOutOfBounds exception via the 'setSeriesNeedle(int index, int type)' method. However, multiple third parties dispute the validity of this finding, suggesting it may have been based on an insufficiently robust vulnerability identification tool.
- CVE-2024-23076High
A potential NullPointerException was reported in JFreeChart version 1.5.4 in the BubbleXYItemLabelGenerator component. However, multiple third parties dispute the existence of this vulnerability, citing insufficient evidence.
Original NVD description (English source)
JFreeChart v1.5.4 was discovered to contain a NullPointerException via the component /chart/annotations/CategoryLineAnnotation. NOTE: this is disputed by multiple third parties who believe there was not reasonable evidence to determine the existence of a vulnerability. The submission may have been based on a tool that is not sufficiently robust for vulnerability identification.