CVE-2013-0431KEV · OVERDUECWE-693

Oracle JRE Sandbox Bypass Vulnerability

Low · published January 31, 2013

Patch now

The score understates this — it's already being exploited

CVSS calls it low at 3.7. It is confirmed in active exploitation. It sits in the 99.8th percentile for exploit probability.

1591
days past CISA
deadline
CVSS v3.1
3.7
EPSS
90%
Percentile
99.8
In the wild
Confirmed
What it is

⚠️ A user-assisted attack can bypass the Java security sandbox with just a crafty click! This sneaky vulnerability in Oracle Java SE 7 makes it easier for attackers to access sensitive data without you even knowing. 🤯 Think of it like a VIP pass that lets someone into a concert's backstage without the usual checks — the security system trusts their ticket, but it’s actually a forgery. Here, the Java Runtime Environment lacks the supervision needed to keep potential intruders at bay! If exploited, this vulnerability could allow an attacker to manipulate applications and access sensitive information, all under the radar. It's like giving someone the password to your vault without realizing they’ve tricked the guard!

Put simply

Think of it like a VIP pass that lets someone into a concert's backstage without the usual checks — the security system trusts their ticket, but it’s actually a forgery. Here, the Java Runtime Environment lacks the supervision needed to keep potential intruders at bay! This vulnerability in the Java Runtime Environment (JRE) allows attackers to bypass security controls related to Java Management Extensions (JMX), enabling unauthorized actions through unresolved vectors. It's a flaw that compromises the very sandbox designed to keep malicious applications at bay.

What to do

If exploited, this vulnerability could allow an attacker to manipulate applications and access sensitive information, all under the radar. It's like giving someone the password to your vault without realizing they’ve tricked the guard! To protect your systems, update your Java Runtime Environment to the latest version immediately and ensure OpenJDK 7 is also patched. Regularly check for security updates to maintain a strong defense against these types of vulnerabilities. 🛡️ You've got this! By staying proactive and patching quickly, you’ll keep your system secure and your users safe. 🚀

The record
Technical detail
CVSS v3.1
3.7 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.90150 · 99.8th percentile
Weakness
CWE-693 · Protection Mechanism Failure
Published
2013-01-31T19:55Z
KEV added
2022-05-25 · due 2022-06-15
Affected products (12)
ProductVersionsFixed in
oracle/jreall versions—
oracle/jreall versions—
oracle/jreall versions—
oracle/jreall versions—
oracle/jreall versions—
oracle/jreall versions—
oracle/jreall versions—
oracle/jreall versions—
oracle/jreall versions—
oracle/jreall versions—
oracle/jreall versions—
oracle/openjdkall versions—
References (39)
http://arstechnica.com/security/2013/01/critical-java-vulnerabilies-confirmed-in-latest-version/ · [email protected]http://blogs.computerworld.com/malware-and-vulnerabilities/21693/yet-another-java-security-flaw-discovered-number-53 · [email protected]http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00001.html · [email protected]http://marc.info/?l=bugtraq&m=136439120408139&w=2 · [email protected]http://marc.info/?l=bugtraq&m=136733161405818&w=2 · [email protected]http://rhn.redhat.com/errata/RHSA-2013-0237.html · [email protected]http://rhn.redhat.com/errata/RHSA-2013-0247.html · [email protected]http://seclists.org/fulldisclosure/2013/Jan/142 · [email protected]http://seclists.org/fulldisclosure/2013/Jan/195 · [email protected]http://security.gentoo.org/glsa/glsa-201406-32.xml · [email protected]http://www.informationweek.com/security/application-security/java-hacker-uncovers-two-flaws-in-latest/240146717 · [email protected]http://www.kb.cert.org/vuls/id/858729 · [email protected]http://www.mandriva.com/security/advisories?name=MDVSA-2013:095 · [email protected]http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html · [email protected]http://www.securityfocus.com/archive/1/525387/30/0/threaded · [email protected]http://www.us-cert.gov/cas/techalerts/TA13-032A.html · [email protected]https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16579 · [email protected]https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19418 · [email protected]https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0056 · [email protected]http://arstechnica.com/security/2013/01/critical-java-vulnerabilies-confirmed-in-latest-version/ · af854a3a-2127-422b-91ae-364da2661108http://blogs.computerworld.com/malware-and-vulnerabilities/21693/yet-another-java-security-flaw-discovered-number-53 · af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00001.html · af854a3a-2127-422b-91ae-364da2661108http://marc.info/?l=bugtraq&m=136439120408139&w=2 · af854a3a-2127-422b-91ae-364da2661108http://marc.info/?l=bugtraq&m=136733161405818&w=2 · af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2013-0237.html · af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2013-0247.html · af854a3a-2127-422b-91ae-364da2661108http://seclists.org/fulldisclosure/2013/Jan/142 · af854a3a-2127-422b-91ae-364da2661108http://seclists.org/fulldisclosure/2013/Jan/195 · af854a3a-2127-422b-91ae-364da2661108http://security.gentoo.org/glsa/glsa-201406-32.xml · af854a3a-2127-422b-91ae-364da2661108http://www.informationweek.com/security/application-security/java-hacker-uncovers-two-flaws-in-latest/240146717 · af854a3a-2127-422b-91ae-364da2661108http://www.kb.cert.org/vuls/id/858729 · af854a3a-2127-422b-91ae-364da2661108http://www.mandriva.com/security/advisories?name=MDVSA-2013:095 · af854a3a-2127-422b-91ae-364da2661108http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html · af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/archive/1/525387/30/0/threaded · af854a3a-2127-422b-91ae-364da2661108http://www.us-cert.gov/cas/techalerts/TA13-032A.html · af854a3a-2127-422b-91ae-364da2661108https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16579 · af854a3a-2127-422b-91ae-364da2661108https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19418 · af854a3a-2127-422b-91ae-364da2661108https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0056 · af854a3a-2127-422b-91ae-364da2661108https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-0431 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 25 MAY 00:00Z
    Added to CISA KEV — remediate by Jun 15
    kev
  • 31 JAN 14:10Z
    Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, and OpenJDK 7, allows user-assisted remote…
    cvelistv5