CVE-2024-22949: Critical severity JFree JFreeChart vulnerability
JFreeChart v1.5.4 was discovered to contain a NullPointerException via the component /chart/annotations/CategoryLineAnnotation. NOTE: this is disputed by multiple third parties who believe there was not reasonable evidence to determine the existence of a vulnerability. The submission may have been based on a tool that is not sufficiently robust for vulnerability identification.
Affected Software
Event History
Frequently Asked Questions
Is the reported issue confirmed?
No. Multiple third parties dispute the report, stating that there was not reasonable evidence to establish that a vulnerability exists and suggesting the submission may have relied on an insufficiently robust identification tool.
What software and component are implicated?
The report identifies JFreeChart version 1.5.4 and the /chart/annotations/CategoryLineAnnotation component. No other affected versions or products are identified in the provided data.
What does the available information say about exploitability?
The assigned CVSS vector indicates network-reachable exploitation with low attack complexity, no privileges, and no user interaction, with high confidentiality and availability impact. However, the provided data does not include an exploit scenario or evidence validating those conditions, and the report is disputed.