CVE-2011-3544

CRITICAL KEV

Java Applet Rhino Script Engine Remote Code Execution

Title source: metasploit

Description

Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7 and 6 Update 27 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability via unknown vectors related to Scripting.

Exploits (2)

exploitdb WORKING POC VERIFIED
by Metasploit · rubyremotemultiple
https://www.exploit-db.com/exploits/18171
metasploit WORKING POC EXCELLENT
by Michael Schierl, juan vazquez · rubypocwin
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/java_rhino.rb

References (16)

Scores

CVSS v3 9.8
EPSS 0.9254
EPSS Percentile 99.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CISA KEV 2022-03-03
VulnCheck KEV 2012-01-14
InTheWild.io 2022-03-03
ENISA EUVD EUVD-2011-3507
CWE
CWE-284
Status published
Products (8)
canonical/ubuntu_linux 10.04
canonical/ubuntu_linux 10.10
canonical/ubuntu_linux 11.04
canonical/ubuntu_linux 11.10
oracle/jdk 1.6.0 (20 CPE variants)
oracle/jdk 1.7.0 (19 CPE variants)
oracle/jdk < 1.6.0
oracle/jre 1.6.0 (6 CPE variants)
Published Oct 19, 2011
KEV Added Mar 03, 2022
Tracked Since Feb 18, 2026