$ cve CVE-2012-1723 JSON

CVE-2012-1723 KEV EXPLOIT

9.8

CRITICAL · CVSS 3.1 · EPSS 93.7% (pctl 100)

Patch first

On CISA KEV — known exploited in the wild, due 2022-03-24.

Description

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.2_37 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.

Scoring

CVSS	9.8 (CRITICAL, v3.1)
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS	93.69% — more likely to be exploited than 100% of all CVEs
Weakness	CWE-284
On CISA KEV	yes — remediate by 2022-03-24
Public exploit	yes
Published	2012-06-16
Last modified	2026-08-06

CISA KEV

Name	Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability
Added	2022-03-03
Due	2022-03-24
Vendor / product	Oracle / Java SE
Ransomware use	known

Affected (8)

Vendor	Product
oracle	jdk
oracle	jre
redhat	enterprise linux desktop
redhat	enterprise linux eus
redhat	enterprise linux server
redhat	enterprise linux server aus
redhat	enterprise linux workstation
redhat	icedtea6

Public exploits

Source	Title	Date
exploit-db	Java Applet - Field Bytecode Verifier Cache Remote Code Execution (Metasploit)	2012-07-11

References

→ the Explorer · watch your stack · NVD