CVE-2024-23076
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk51th percentile - higher than 51% of all known CVEs
Summary
A potential NullPointerException was reported in JFreeChart version 1.5.4 in the BubbleXYItemLabelGenerator component. However, multiple third parties dispute the existence of this vulnerability, citing insufficient evidence.
Risk Assessment
The risk to the organization is low as the vulnerability is disputed and may not be a real threat. If confirmed, it could cause application crashes when processing specific data.
Recommendation
It is recommended to monitor official JFreeChart updates and verify the report through trusted sources. No urgent remediation actions are required until the situation is clarified.
Other vulnerabilities in JFreeChart
See all- CVE-2024-22949Critical
A NullPointerException was discovered in JFreeChart v1.5.4 via the component /chart/annotations/CategoryLineAnnotation. However, multiple third parties dispute the existence of this vulnerability, suggesting the submission may have been based on a tool that is not sufficiently robust for vulnerability identification.
- CVE-2024-23077High
JFreeChart v1.5.4 was reported to have an ArrayIndexOutOfBounds vulnerability in the /chart/plot/CompassPlot.java component. However, multiple third parties dispute the existence of this vulnerability, suggesting the report may have been based on an insufficiently robust tool.
- CVE-2023-52070High
JFreeChart version 1.5.4 was found to be vulnerable to an ArrayIndexOutOfBounds exception via the 'setSeriesNeedle(int index, int type)' method. However, multiple third parties dispute the validity of this finding, suggesting it may have been based on an insufficiently robust vulnerability identification tool.
Original NVD description (English source)
JFreeChart v1.5.4 was discovered to contain a NullPointerException via the component /labels/BubbleXYItemLabelGenerator.java. NOTE: this is disputed by multiple third parties who believe there was not reasonable evidence to determine the existence of a vulnerability. The submission may have been based on a tool that is not sufficiently robust for vulnerability identification.