$ cve CVE-2013-2423 JSON

CVE-2013-2423 KEV EXPLOIT

3.7

LOW · CVSS 3.1 · EPSS 85.2% (pctl 100)

Patch first

On CISA KEV — known exploited in the wild, due 2022-06-15.

Description

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 7, allows remote attackers to affect integrity via unknown vectors related to HotSpot. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from the original researcher that this vulnerability allows remote attackers to bypass permission checks by the MethodHandles method and modify arbitrary public final fields using reflection and type confusion, as demonstrated using integer and double fields to disable the security manager.

Scoring

CVSS	3.7 (LOW, v3.1)
Vector	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
EPSS	85.22% — more likely to be exploited than 100% of all CVEs
Weakness	CWE-284
On CISA KEV	yes — remediate by 2022-06-15
Public exploit	yes
Published	2013-04-17
Last modified	2026-06-16

CISA KEV

Name	Oracle JRE Unspecified Vulnerability
Added	2022-05-25
Due	2022-06-15
Vendor / product	Oracle / Java Runtime Environment (JRE)
Ransomware use	none reported

Affected (3)

Vendor	Product
canonical	ubuntu linux
opensuse	opensuse
oracle	jre

Public exploits

Source	Title	Date
exploit-db	Java Applet - Reflection Type Confusion Remote Code Execution (Metasploit)	2013-04-23

References

→ the Explorer · watch your stack · NVD