Security Resilience

CVE-2024-21003

Oracle Graalvm 20.3.13 … 21.3.9

Published
16 April 2024
Modified
29 March 2025
Patch / advisory
View advisory
CVSS Score v3.1 3.1
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
EPSS Score 0.0086 58th percentile
Risk Priority 30 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2024-21003 is a low-severity Execution with Unnecessary Privileges (CWE-250) vulnerability in Oracle Graalvm. Its CVSS base score is 3.1 (Low).

Operationally, exploitation aligns with the MITRE ATT&CK technique Data Obfuscation (T1001); ranked in the top 42% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-6 (Least Privilege) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JavaFX). Supported versions that are affected are Oracle Java SE: 8u401; Oracle GraalVM Enterprise Edition: 20.3.13 and 21.3.9. Difficult to exploit vulnerability allows unauthenticated…

more

attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.1 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N).

CWE(s)
NVD-CWE-noinfoCWE-250

Related Threats

MITRE ATT&CK Enterprise Techniques

T1001 Data Obfuscation Command And Control
Adversaries may obfuscate command and control traffic to make it more difficult to detect.
attack.mitre.org →
T1001.001 Junk Data Command And Control
Adversaries may add junk data to protocols used for command and control to make detection more difficult.
attack.mitre.org →
T1007 System Service Discovery Discovery
Adversaries may try to gather information about registered local system services.
attack.mitre.org →
T1011 Exfiltration Over Other Network Medium Exfiltration
Adversaries may attempt to exfiltrate data over a different network medium than the command and control channel.
attack.mitre.org →
T1027.003 Steganography Stealth
Adversaries may use steganography techniques in order to prevent the detection of hidden information.
attack.mitre.org →
T1027.004 Compile After Delivery Stealth
Adversaries may attempt to make payloads difficult to discover and analyze by delivering files to victims as uncompiled code.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2024-21004Same product: Netapp Active Iq Unified Manager
CVE-2024-21002Same product: Netapp Active Iq Unified Manager
CVE-2024-21005Same product: Netapp Active Iq Unified Manager
CVE-2024-21131Same product: Netapp Active Iq Unified Manager
CVE-2024-21138Same product: Netapp Active Iq Unified Manager
CVE-2024-21085Same product: Netapp Active Iq Unified Manager
CVE-2023-27312Same product class: NAS / storage appliance
CVE-2023-27313Same product class: NAS / storage appliance
CVE-2024-21012Same product: Netapp Active Iq Unified Manager
CVE-2024-21011Same product: Netapp Active Iq Unified Manager

Affected Assets

oracle
graalvm
20.3.13, 21.3.9
oracle
jdk
1.8.0
oracle
jre
1.8.0
netapp
active iq unified manager
all versions
netapp
data infrastructure insights acquisition unit
all versions
netapp
data infrastructure insights storage workload security agent
all versions
netapp
oncommand insight
all versions
netapp
oncommand workflow automation
all versions

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)
  • 4 hardening rules · 4 OS baselines
Validate
Prove the fix (OWASP ASVS)
  • V10.2.3
  • V13.2.2

Mitigating Controls (NIST 800-53 r5) AI

AC-6 Least Privilege good match

Least privilege directly requires that only the minimum necessary authorizations are granted, structurally eliminating execution with unnecessary privileges.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-05 mostly match
blocks

PR.AA-05 directly enforces least privilege so largely eliminates CWE-250 at design time, yet the weakness can still arise from runtime escalation paths, third-party code, or misapplied role definitions outside this single control.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.5.14 Information transfer partial match
removes
A.5.15 Access control partial match
blocks

A.5.15's policy, requirements, and rules for determining/minimizing access rights (incl. privileged access restrictions, need-to-know, least-privilege-like mapping, and role-based consistency) directly stop most unnecessary-privilege execution by design; bounded remainder is runtime elevation or misconfigured enforcement that still requires other controls (e.g. 8.2, 8.3) to act.

A.5.16 Identity management partial match
removes
A.5.17 Authentication information partial match
removes
A.5.18 Access rights partial match
blocks

Requiring explicit justification and time-limited grants discourages the routine allocation of unnecessary privileges that would otherwise allow execution with more rights than required.

A.5.35 Independent review of information security partial match
finds

Independent scrutiny can identify processes or services still running with unnecessary privileges and drive their reduction before an attacker can abuse them.

Hardening callouts derived

Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (higher-evidence rows only; rows rated `none` are excluded).

Windows 10 (1 rule)
  • V-220712 Only accounts responsible for the administration of a system must have Administrator rights on the system. blocks CWE-250
Windows Server 2016 (1 rule)
  • V-225007 Only administrators responsible for the member server or standalone or nondomain-joined system must have Administrator rights on the system. blocks CWE-250
Windows Server 2019 (1 rule)
  • V-205746 Windows Server 2019 must only allow Administrators responsible for the member server or standalone or nondomain-joined system to have Administrator rights on the system. blocks CWE-250

References