CVE-2020-14718: High severity oracle graalvm enterprise edition vulnerability

Published Jul 15, 2020

Updated

Vulnerability in the Oracle GraalVM Enterprise Edition product of Oracle GraalVM (component: JVMCI). Supported versions that are affected are 19.3.2 and 20.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in takeover of Oracle GraalVM Enterprise Edition. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

Affected Software

2 affected components

Oracle GraalVM=19.3.2

Oracle GraalVM=20.1.0

Event History

Jul 15, 2020

CVE Published

via MITRE·05:34 PM

Data Sourced

via MITRE·05:34 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2020-14718?

CVE-2020-14718 is considered an easily exploitable vulnerability that allows a high privileged attacker to compromise Oracle GraalVM.

How do I fix CVE-2020-14718?

To fix CVE-2020-14718, it is recommended to upgrade Oracle GraalVM to a patched version beyond 20.1.0 and 19.3.2.

Who is affected by CVE-2020-14718?

CVE-2020-14718 affects users of Oracle GraalVM Enterprise Edition versions 19.3.2 and 20.1.0.

What component is affected in CVE-2020-14718?

The component affected in CVE-2020-14718 is the JVMCI (Java Virtual Machine Compiler Interface) of Oracle GraalVM.

Is network access required to exploit CVE-2020-14718?

Yes, CVE-2020-14718 requires network access via multiple protocols to be exploited.