CVE-2024-22949: Critical severity JFree JFreeChart vulnerability

Published Apr 8, 2024

Updated

JFreeChart v1.5.4 was discovered to contain a NullPointerException via the component /chart/annotations/CategoryLineAnnotation. NOTE: this is disputed by multiple third parties who believe there was not reasonable evidence to determine the existence of a vulnerability. The submission may have been based on a tool that is not sufficiently robust for vulnerability identification.

Affected Software

2 affected components

JFree JFreeChart

JFree JFreeChart=1.5.4

Event History

Apr 8, 2024

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·11:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

Is the reported issue confirmed?

No. Multiple third parties dispute the report, stating that there was not reasonable evidence to establish that a vulnerability exists and suggesting the submission may have relied on an insufficiently robust identification tool.

What software and component are implicated?

The report identifies JFreeChart version 1.5.4 and the /chart/annotations/CategoryLineAnnotation component. No other affected versions or products are identified in the provided data.

What does the available information say about exploitability?

The assigned CVSS vector indicates network-reachable exploitation with low attack complexity, no privileges, and no user interaction, with high confidentiality and availability impact. However, the provided data does not include an exploit scenario or evidence validating those conditions, and the report is disputed.

CVE-2024-22949: Critical severity JFree JFreeChart vulnerability

Affected Software

Event History

Frequently Asked Questions

Is the reported issue confirmed?

What software and component are implicated?

What does the available information say about exploitability?

Company

Resources

Contact

Frequently Asked Questions

Is the reported issue confirmed?

What software and component are implicated?

What does the available information say about exploitability?