CVE-2024-23077
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
JFreeChart v1.5.4 was reported to have an ArrayIndexOutOfBounds vulnerability in the /chart/plot/CompassPlot.java component. However, multiple third parties dispute the existence of this vulnerability, suggesting the report may have been based on an insufficiently robust tool.
Risk Assessment
If the vulnerability is real, it could lead to application crashes (DoS) when processing specially crafted data. However, due to the disputed nature of the report, the risk is uncertain.
Recommendation
Monitor official JFreeChart updates and verify the report through trusted sources. No immediate update is required until the situation is clarified.
Other vulnerabilities in JFreeChart
See all- CVE-2024-22949Critical
A NullPointerException was discovered in JFreeChart v1.5.4 via the component /chart/annotations/CategoryLineAnnotation. However, multiple third parties dispute the existence of this vulnerability, suggesting the submission may have been based on a tool that is not sufficiently robust for vulnerability identification.
- CVE-2023-52070High
JFreeChart version 1.5.4 was found to be vulnerable to an ArrayIndexOutOfBounds exception via the 'setSeriesNeedle(int index, int type)' method. However, multiple third parties dispute the validity of this finding, suggesting it may have been based on an insufficiently robust vulnerability identification tool.
- CVE-2024-23076High
A potential NullPointerException was reported in JFreeChart version 1.5.4 in the BubbleXYItemLabelGenerator component. However, multiple third parties dispute the existence of this vulnerability, citing insufficient evidence.
Original NVD description (English source)
JFreeChart v1.5.4 was discovered to be vulnerable to ArrayIndexOutOfBounds via the component /chart/plot/CompassPlot.java. NOTE: this is disputed by multiple third parties who believe there was not reasonable evidence to determine the existence of a vulnerability. The submission may have been based on a tool that is not sufficiently robust for vulnerability identification.