CVE-2024-23083
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk47th percentile - higher than 47% of all known CVEs
Summary
A NullPointerException was discovered in Time4J Base v5.9.3 in the FormatUtils::useDefaultWeekmodel(Locale) method. Note: multiple third parties dispute the existence of this vulnerability, citing insufficient evidence.
Risk Assessment
The potential risk involves possible application crashes due to invalid input, but the actual threat is uncertain given the disputed nature of the vulnerability.
Recommendation
Monitor official updates for Time4J Base and consider temporary mitigation by validating input passed to the FormatUtils::useDefaultWeekmodel method.
Original NVD description (English source)
Time4J Base v5.9.3 was discovered to contain a NullPointerException via the component net.time4j.format.internal.FormatUtils::useDefaultWeekmodel(Locale). NOTE: this is disputed by multiple third parties who believe there was not reasonable evidence to determine the existence of a vulnerability. The submission may have been based on a tool that is not sufficiently robust for vulnerability identification.