CVE-2013-0431lowunder attackransomwareCWE-693

CVE-2013-0431

Published · Updated

Follow this CVE+ Monitor Java Runtime Environment

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

95Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 3.7epss 90%
from disclosure to weapon25 days
Published on NVDJan 31
1st PoC+25d
metasploitJan 19
CISA KEV+3401d
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Affected
1 product
Red Hat Enterprise Linux 5
no_fix_planned: Will not fix
Fixed
14 products (202 components)
Red Hat Enterprise Linux Server Supplementary (v. 5) · Red Hat Enterprise Linux Server Supplementary (v. 6) · Red Hat Enterprise Linux Desktop Supplementary (v. 6) · Red Hat Enterprise Linux Workstation Supplementary (v. 6) · Red Hat Enterprise Linux (v. 5 server) · and others 9
fix ↗
Not affected
2 products (37 components) — because the vulnerable code is not present in the product
Red Hat Enterprise Linux 6 · Red Hat Enterprise Linux 5
Action required by CISAfederal deadline: 2022-06-15

Apply updates per vendor instructions.

In short

A flaw in Java's security sandbox allows attackers to escape restrictions and run malicious code if a user interacts with a specially crafted file or website. This bypasses Java's built-in protections that normally prevent untrusted programs from accessing your system.

Technical detail

An unspecified vulnerability in the JMX (Java Management Extensions) subsystem of Oracle Java SE 7 (up to Update 11) and OpenJDK 7 permits user-assisted remote code execution by circumventing sandbox restrictions. The attack vector requires user interaction and exploits weaknesses in the security manager's access control mechanisms, enabling arbitrary code execution outside the intended security boundary.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, and OpenJDK 7, allows user-assisted remote attackers to bypass the Java security sandbox via unspecified vectors related to JMX, aka "Issue 52," a different vulnerability than CVE-2013-1490.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.