CVE-2024-23076 - Vulnerability Details - OpenCVE

JFreeChart v1.5.4 was discovered to contain a NullPointerException via the component /labels/BubbleXYItemLabelGenerator.java. NOTE: this is disputed by multiple third parties who believe there was not reasonable evidence to determine the existence of a vulnerability. The submission may have been based on a tool that is not sufficiently robust for vulnerability identification.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00271.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Jfree	Jfreechart

Configuration 1 [-]

cpe:2.3:a:jfree:jfreechart:1.5.4:*:*:*:*:*:*:*

No data.

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
http://jfreechart.com
https://gist.github.com/LLM4IG/115de1f7c3051403f0301cee0d293518
https://github.com/jfree/jfreechart
https://nvd.nist.gov/vuln/detail/CVE-2024-23076
https://www.cve.org/CVERecord?id=CVE-2024-23076

History

Tue, 27 May 2025 13:45:00 +0000

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:jfree:jfreechart:1.5.4:::::::*

Fri, 25 Oct 2024 22:00:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-395

Fri, 25 Oct 2024 21:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Jfree Jfree jfreechart
Weaknesses		CWE-476
CPEs		cpe:2.3:o:jfree:jfreechart::::::::
Vendors & Products		Jfree Jfree jfreechart
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 22 Aug 2024 20:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-395

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2024-04-10T00:00:00

Updated: 2024-10-25T20:17:57.300Z

Reserved: 2024-01-11T00:00:00

Link: CVE-2024-23076

Vulnrichment

Updated: 2024-08-01T22:51:11.307Z

NVD

Status : Analyzed

Published: 2024-04-10T12:15:09.190

Modified: 2025-05-27T13:29:49.627

Link: CVE-2024-23076

Redhat

Severity : Moderate

Publid Date: 2024-04-10T00:00:00Z

Links: CVE-2024-23076 - Bugzilla

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2024-23076", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2024-10-25T20:17:57.300Z", "dateReserved": "2024-01-11T00:00:00", "datePublished": "2024-04-10T00:00:00"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-04-11T19:11:21.710988"}, "descriptions": [{"lang": "en", "value": "JFreeChart v1.5.4 was discovered to contain a NullPointerException via the component /labels/BubbleXYItemLabelGenerator.java. NOTE: this is disputed by multiple third parties who believe there was not reasonable evidence to determine the existence of a vulnerability. The submission may have been based on a tool that is not sufficiently robust for vulnerability identification."}], "tags": ["disputed"], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "http://jfreechart.com"}, {"url": "https://github.com/jfree/jfreechart"}, {"url": "https://gist.github.com/LLM4IG/115de1f7c3051403f0301cee0d293518"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T22:51:11.307Z"}, "title": "CVE Program Container", "references": [{"url": "http://jfreechart.com", "tags": ["x_transferred"]}, {"url": "https://github.com/jfree/jfreechart", "tags": ["x_transferred"]}, {"url": "https://gist.github.com/LLM4IG/115de1f7c3051403f0301cee0d293518", "tags": ["x_transferred"]}]}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-476", "lang": "en", "description": "CWE-476 NULL Pointer Dereference"}]}], "affected": [{"vendor": "jfree", "product": "jfreechart", "cpes": ["cpe:2.3:o:jfree:jfreechart:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "1.5.4", "status": "affected"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-04-11T16:51:09.885636Z", "id": "CVE-2024-23076", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-25T20:17:57.300Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://jfreechart.com", "tags": ["x_transferred"]}, {"url": "https://github.com/jfree/jfreechart", "tags": ["x_transferred"]}, {"url": "https://gist.github.com/LLM4IG/115de1f7c3051403f0301cee0d293518", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T22:51:11.307Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-23076", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-04-11T16:51:09.885636Z"}}}], "affected": [{"cpes": ["cpe:2.3:o:jfree:jfreechart:*:*:*:*:*:*:*:*"], "vendor": "jfree", "product": "jfreechart", "versions": [{"status": "affected", "version": "1.5.4"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-476", "description": "CWE-476 NULL Pointer Dereference"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-22T18:29:35.398Z"}}], "cna": {"tags": ["disputed"], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "http://jfreechart.com"}, {"url": "https://github.com/jfree/jfreechart"}, {"url": "https://gist.github.com/LLM4IG/115de1f7c3051403f0301cee0d293518"}], "descriptions": [{"lang": "en", "value": "JFreeChart v1.5.4 was discovered to contain a NullPointerException via the component /labels/BubbleXYItemLabelGenerator.java. NOTE: this is disputed by multiple third parties who believe there was not reasonable evidence to determine the existence of a vulnerability. The submission may have been based on a tool that is not sufficiently robust for vulnerability identification."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-04-11T19:11:21.710988"}}}, "cveMetadata": {"cveId": "CVE-2024-23076", "state": "PUBLISHED", "dateUpdated": "2024-10-25T20:17:57.300Z", "dateReserved": "2024-01-11T00:00:00", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2024-04-10T00:00:00", "assignerShortName": "mitre"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:jfree:jfreechart:1.5.4:*:*:*:*:*:*:*", "matchCriteriaId": "4DC9D75E-294E-44D6-BDA5-7D6BC240BBE0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [{"sourceIdentifier": "cve@mitre.org", "tags": ["disputed"]}], "descriptions": [{"lang": "en", "value": "JFreeChart v1.5.4 was discovered to contain a NullPointerException via the component /labels/BubbleXYItemLabelGenerator.java. NOTE: this is disputed by multiple third parties who believe there was not reasonable evidence to determine the existence of a vulnerability. The submission may have been based on a tool that is not sufficiently robust for vulnerability identification."}, {"lang": "es", "value": "Se descubri\u00f3 que FreeChart v1.5.4 conten\u00eda una excepci\u00f3n NullPointerException a trav\u00e9s del componente /labels/BubbleXYItemLabelGenerator.java."}], "id": "CVE-2024-23076", "lastModified": "2025-05-27T13:29:49.627", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2024-04-10T12:15:09.190", "references": [{"source": "cve@mitre.org", "tags": ["Broken Link"], "url": "http://jfreechart.com"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://gist.github.com/LLM4IG/115de1f7c3051403f0301cee0d293518"}, {"source": "cve@mitre.org", "tags": ["Product"], "url": "https://github.com/jfree/jfreechart"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Broken Link"], "url": "http://jfreechart.com"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://gist.github.com/LLM4IG/115de1f7c3051403f0301cee0d293518"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Product"], "url": "https://github.com/jfree/jfreechart"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-476"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "jfreechart: Null pointer exception", "id": "2274494", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2274494"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-754", "details": ["JFreeChart v1.5.4 was discovered to contain a NullPointerException via the component /labels/BubbleXYItemLabelGenerator.java. NOTE: this is disputed by multiple third parties who believe there was not reasonable evidence to determine the existence of a vulnerability. The submission may have been based on a tool that is not sufficiently robust for vulnerability identification.", "A NULL pointer exception vulnerability was found in Freechart. In the method generateLabelString, if the dataset parameter is NULL, a NULL pointer exception is thrown."], "name": "CVE-2024-23076", "package_state": [{"cpe": "cpe:/a:redhat:ocp_tools", "fix_state": "Not affected", "package_name": "jenkins", "product_name": "OpenShift Developer Tools and Services"}, {"cpe": "cpe:/a:redhat:amq_broker:7", "fix_state": "Not affected", "package_name": "jfreechart", "product_name": "Red Hat AMQ Broker 7"}, {"cpe": "cpe:/a:redhat:build_keycloak:", "fix_state": "Not affected", "package_name": "jfreechart", "product_name": "Red Hat Build of Keycloak"}, {"cpe": "cpe:/a:redhat:optaplanner:::el6", "fix_state": "Not affected", "package_name": "jfreechart", "product_name": "Red Hat build of OptaPlanner 8"}, {"cpe": "cpe:/a:redhat:jboss_data_grid:8", "fix_state": "Not affected", "package_name": "jfreechart", "product_name": "Red Hat Data Grid 8"}, {"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Not affected", "package_name": "jfreechart", "product_name": "Red Hat Fuse 7"}, {"cpe": "cpe:/a:redhat:integration:1", "fix_state": "Not affected", "package_name": "jfreechart", "product_name": "Red Hat Integration Camel K 1"}, {"cpe": "cpe:/a:redhat:jboss_data_grid:7", "fix_state": "Not affected", "package_name": "jfreechart", "product_name": "Red Hat JBoss Data Grid 7"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7", "fix_state": "Not affected", "package_name": "jfreechart", "product_name": "Red Hat JBoss Enterprise Application Platform 7"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:8", "fix_state": "Not affected", "package_name": "jfreechart", "product_name": "Red Hat JBoss Enterprise Application Platform 8"}, {"cpe": "cpe:/a:redhat:jbosseapxp", "fix_state": "Not affected", "package_name": "jfreechart", "product_name": "Red Hat JBoss Enterprise Application Platform Expansion Pack"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_web_server:6", "fix_state": "Not affected", "package_name": "jfreechart", "product_name": "Red Hat JBoss Web Server 6"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_web_server:6", "fix_state": "Not affected", "package_name": "jws6-mod_cluster", "product_name": "Red Hat JBoss Web Server 6"}, {"cpe": "cpe:/a:redhat:openshift:3.11", "fix_state": "Not affected", "package_name": "jenkins", "product_name": "Red Hat OpenShift Container Platform 3.11"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_bpms_platform:7", "fix_state": "Not affected", "package_name": "jfreechart", "product_name": "Red Hat Process Automation 7"}, {"cpe": "cpe:/a:redhat:red_hat_single_sign_on:7", "fix_state": "Not affected", "package_name": "jfreechart", "product_name": "Red Hat Single Sign-On 7"}, {"cpe": "cpe:/a:redhat:amq_streams:1", "fix_state": "Not affected", "package_name": "jfreechart", "product_name": "streams for Apache Kafka"}], "public_date": "2024-04-10T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-23076\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-23076\nhttps://gist.github.com/LLM4IG/115de1f7c3051403f0301cee0d293518"], "threat_severity": "Moderate"}