{
    "id": "CVE-2013-1488",
    "published": "2013-03-08 18:55:01",
    "last_modified": "2026-06-16 23:51:31",
    "cvss_score": "10.0",
    "cvss_severity": "HIGH",
    "cvss_version": "2.0",
    "cvss_vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
    "cwe": "CWE-94",
    "description": "The Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 6 and 7, allows remote attackers to execute arbitrary code via unspecified vectors involving reflection, Libraries, \"improper toString calls,\" and the JDBC driver manager, as demonstrated by James Forshaw during a Pwn2Own competition at CanSecWest 2013.",
    "epss_score": "0.87227",
    "epss_percentile": "0.99747",
    "kev": 0,
    "kev_due": null,
    "has_exploit": 1,
    "updated_at": "2026-09-26 18:18:43",
    "priority": {
        "rank": 2,
        "label": "Patch early",
        "why": "A public exploit exists."
    },
    "products": [
        {
            "vendor": "oracle",
            "product": "jdk"
        },
        {
            "vendor": "oracle",
            "product": "jre"
        }
    ],
    "kev_detail": null,
    "exploits": [
        {
            "source": "exploit-db",
            "ref_id": "26135",
            "title": "Java Applet - Driver Manager Privileged 'toString()' Remote Code Execution (Metasploit)",
            "date": "2013-06-11",
            "url": "https://www.exploit-db.com/exploits/26135"
        }
    ],
    "refs_list": [
        "http://blog.fuseyism.com/index.php/2013/04/22/security-icedtea-2-3-9-for-openjdk-7-released/",
        "http://blog.fuseyism.com/index.php/2013/04/25/security-icedtea-1-11-11-1-12-5-for-openjdk-6-released/",
        "http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Pwn2Own-2013/ba-p/5981157",
        "http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/a19614a3dabb",
        "http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00007.html",
        "http://lists.opensuse.org/opensuse-updates/2013-05/msg00017.html",
        "http://lists.opensuse.org/opensuse-updates/2013-06/msg00099.html",
        "http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2013-April/022796.html",
        "http://rhn.redhat.com/errata/RHSA-2013-0752.html",
        "http://rhn.redhat.com/errata/RHSA-2013-0757.html",
        "http://security.gentoo.org/glsa/glsa-201406-32.xml",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2013:145",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2013:161",
        "http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html",
        "http://www.ubuntu.com/usn/USN-1806-1",
        "http://www.us-cert.gov/ncas/alerts/TA13-107A",
        "http://www.zdnet.com/pwn2own-down-go-all-the-browsers-7000012283/",
        "https://bugzilla.redhat.com/show_bug.cgi?id=920247",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16511",
        "https://twitter.com/thezdi/status/309425888188043264",
        "https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0124",
        "https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0130",
        "http://blog.fuseyism.com/index.php/2013/04/22/security-icedtea-2-3-9-for-openjdk-7-released/",
        "http://blog.fuseyism.com/index.php/2013/04/25/security-icedtea-1-11-11-1-12-5-for-openjdk-6-released/",
        "http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Pwn2Own-2013/ba-p/5981157"
    ]
}