CVE-2013-2460

EXPLOITED

Oracle Java SE <7 Update 21 - Info Disclosure

Title source: llm

Description

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Serviceability. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "insufficient access checks" in the tracing component.

Exploits (2)

exploitdb WORKING POC VERIFIED
by Metasploit · rubyremotemultiple
https://www.exploit-db.com/exploits/26529
metasploit WORKING POC GREAT
by Adam Gowdiak, s advisory and also POC · rubypocwin
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/java_jre17_provider_skeleton.rb

References (16)

Scores

EPSS 0.9171
EPSS Percentile 99.7%

Details

VulnCheck KEV 2021-08-17
Status published
Products (4)
oracle/jdk 1.7.0 (14 CPE variants)
oracle/jdk < 1.7.0
oracle/jre 1.7.0 (14 CPE variants)
oracle/jre < 1.7.0
Published Jun 18, 2013
Tracked Since Feb 18, 2026