CVE-2013-2423: Oracle JRE Unspecified Vulnerability

Description

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 7, allows remote attackers to affect integrity via unknown vectors related to HotSpot. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from the original researcher that this vulnerability allows remote attackers to bypass permission checks by the MethodHandles method and modify arbitrary public final fields using reflection and type confusion, as demonstrated using integer and double fields to disable the security manager.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack vector

Network

Complexity

High

Privileges

None

User interaction

None

Confidentiality

None

Integrity

Low

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)85.2% · higher than 100% of CVEs

Exploited in the wildYes

CISA KEVListed May 25, 2022

Federal remediation dueJun 15, 2022

Ransomware campaign useNot known

Affected products

Which versions

JR

Jre · Oracle

1.7.0; 1.7.0; 1.7.0; 1.7.0; 1.7.0; 1.7.0; +7 more · source: NVD

OP

Opensuse · Opensuse

12.3 · source: NVD

UL

Ubuntu Linux · Canonical

12.10 · source: NVD

JR

Java Runtime Environment (JRE) · Oracle

All versions, or not specified · source: KEV