CVE-2013-0431Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, and OpenJDK 7, allows user-assisted remote attackers to bypass the Java security sandb…
Updated under an hour ago ()
Does this affect you?
It affects oracle jre and 1 other product. Add what you run to find out whether that includes you.
CISA lists it as known exploited since May 25, 2022; federal agencies had to remediate by Jun 15, 2022, and it is known to be used in ransomware. Treat that date as your deadline.
Do this next
Free account, 1 product
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, and OpenJDK 7, allows user-assisted remote attackers to bypass the Java security sandbox via unspecified vectors related to JMX, aka "Issue 52," a different vulnerability than CVE-2013-1490.
- CVSS
- 3.7 LOW (v3.1, CISA ADP)CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness (CWE)
- CWE-693
- Known exploited
- Added to CISA KEV May 25, 2022; federal remediation due Jun 15, 2022; known ransomware useApply updates per vendor instructions.
- EPSS (exploitation in the next 30 days)
- 90.15% (percentile 100)
- Assigned by
- oracle
- NVD analysis
- Analyzed
- Record last updated
- Oct 1, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
oracle jre oracle:jre | 1.7.0; 1.7.0; 1.7.0; 1.7.0; 1.7.0; 1.7.0; 1.7.0; 1.7.0; and 3 more ranges | NVD |
oracle openjdk oracle:openjdk | 7 | NVD |
References
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19418vdb-entry, signature, x-refsource-oval, broken-link
- http://security.gentoo.org/glsa/glsa-201406-32.xmlvendor-advisory, x-refsource-gentoo, third-party-advisory
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:095vendor-advisory, x-refsource-mandriva, not-applicable
- http://www.informationweek.com/security/application-security/java-hacker-uncovers-two-flaws-in-latest/240146717x-refsource-misc, broken-link
- http://www.us-cert.gov/cas/techalerts/TA13-032A.htmlthird-party-advisory, x-refsource-cert, us-government-resource
- http://seclists.org/fulldisclosure/2013/Jan/142mailing-list, x-refsource-fulldisc, third-party-advisory
- http://www.kb.cert.org/vuls/id/858729third-party-advisory, x-refsource-cert-vn, us-government-resource
- http://rhn.redhat.com/errata/RHSA-2013-0237.htmlvendor-advisory, x-refsource-redhat, third-party-advisory
- http://marc.info/?l=bugtraq&m=136439120408139&w=2vendor-advisory, x-refsource-hp, mailing-list, third-party-advisory
- http://rhn.redhat.com/errata/RHSA-2013-0247.htmlvendor-advisory, x-refsource-redhat, third-party-advisory
- http://arstechnica.com/security/2013/01/critical-java-vulnerabilies-confirmed-in-latest-version/x-refsource-misc, third-party-advisory
- http://seclists.org/fulldisclosure/2013/Jan/195mailing-list, x-refsource-fulldisc, third-party-advisory
- http://marc.info/?l=bugtraq&m=136733161405818&w=2vendor-advisory, x-refsource-hp, mailing-list, third-party-advisory
- http://blogs.computerworld.com/malware-and-vulnerabilities/21693/yet-another-java-security-flaw-discovered-number-53x-refsource-misc, not-applicable
- http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00001.htmlvendor-advisory, x-refsource-suse, third-party-advisory
- http://www.securityfocus.com/archive/1/525387/30/0/threadedmailing-list, x-refsource-bugtraq, third-party-advisory, vdb-entry
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16579vdb-entry, signature, x-refsource-oval, broken-link
- http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.htmlx-refsource-confirm, vendor-advisory
- https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0056x-refsource-confirm, third-party-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-0431us-government-resource
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.