CVE-2020-2799: Medium severity oracle graalvm enterprise edition vulnerability

Published Apr 15, 2020

Updated

Vulnerability in the Oracle GraalVM Enterprise Edition product of Oracle GraalVM (component: GraalVM Compiler). Supported versions that are affected are 19.3.1 and 20.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise Oracle GraalVM Enterprise Edition. While the vulnerability is in Oracle GraalVM Enterprise Edition, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle GraalVM Enterprise Edition accessible data. CVSS 3.0 Base Score 6.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N).

Affected Software

2 affected components

Oracle GraalVM=19.3.1

Oracle GraalVM=20.0.0

Event History

Apr 15, 2020

CVE Published

via MITRE·01:29 PM

Data Sourced

via MITRE·01:29 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2020-2799?

CVE-2020-2799 has been classified as a difficult to exploit vulnerability with potential for significant impact.

How do I fix CVE-2020-2799?

To remediate CVE-2020-2799, users should upgrade to a non-affected version of Oracle GraalVM Enterprise Edition.

Which versions of Oracle GraalVM are affected by CVE-2020-2799?

CVE-2020-2799 affects Oracle GraalVM Enterprise Edition versions 19.3.1 and 20.0.0.

Can a low privileged attacker exploit CVE-2020-2799?

Yes, a low privileged attacker with network access can exploit CVE-2020-2799 using multiple protocols.

What components of Oracle GraalVM are involved in CVE-2020-2799?

CVE-2020-2799 involves a vulnerability in the GraalVM Compiler component of Oracle GraalVM Enterprise Edition.