CVE-2013-2423
LOW KEV RANSOMWAREOracle Jre - Improper Access Control
Title source: ruleDescription
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 7, allows remote attackers to affect integrity via unknown vectors related to HotSpot. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from the original researcher that this vulnerability allows remote attackers to bypass permission checks by the MethodHandles method and modify arbitrary public final fields using reflection and type confusion, as demonstrated using integer and double fields to disable the security manager.
Exploits (2)
exploitdb
WORKING POC
VERIFIED
by Metasploit · rubyremotemultiple
https://www.exploit-db.com/exploits/24976
metasploit
WORKING POC
EXCELLENT
by Jeroen Frijters, juan vazquez · rubypocwin
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/java_jre17_reflection_types.rb
References (17)
Scores
CVSS v3
3.7
EPSS
0.9340
EPSS Percentile
99.8%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Details
CISA KEV
2022-05-25
VulnCheck KEV
2013-05-20
InTheWild.io
2014-02-21
ENISA EUVD
EUVD-2013-2369
Ransomware Use
Confirmed
CWE
CWE-284
Status
published
Products (3)
canonical/ubuntu_linux
12.10
opensuse/opensuse
12.3
oracle/jre
1.7.0 (13 CPE variants)
Published
Apr 17, 2013
KEV Added
May 25, 2022
Tracked Since
Feb 18, 2026