WaratekVRT Sign in

CVE-2010-0840 Oracle JRE

Affected softwareOracle JRE
Affected versions6 Update 18, 5.0 Update 23, 1.4.2_25
Severity9.8 Critical CVSS 3.1 3 scores
Fixed inJava SE CPU Mar 2010
Published1 Apr 2010
Updated16 Jun 2026

Description

Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, and 1.4.2_25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the March 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is related to improper checks when executing privileged methods in the Java Runtime Environment (JRE), which allows attackers to execute arbitrary code via (1) an untrusted object that extends the trusted class but has not modified a certain method, or (2) "a similar trust issue with interfaces," aka "Trusted Methods Chaining Remote Code Execution Vulnerability."

Exploitation status

Exploited

Confirmed real-world exploitation.
  • CISA KEV listed Confirmed exploitation in the wild. Added 2022-05-25 · remediation due 2022-06-15 · ransomware use: unknown
  • VulnCheck KEV listed Exploitation reported in the wild. 4 citations · earliest 2011-07-26.
  • CISA Vulnrichment exploitation: active CISA records active exploitation. Automatable: yes, technical impact: total.
  • Indexed PoC 2 indexed Published artifacts you can open, in Exploit-DB, Metasploit; first seen 2010-12-15.
  • EPSS 96% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.9% of all scored CVEs.

VulnCheck KEV

Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2010-0840 in VulnCheck (free account).

EvidenceSourceDetailDate
Reported exploitation hkcert.org /blog/large-scale-injection-incidents-targeting-oscommerce-websites 2011-07-26
Reported exploitation cybersecurityworks.com /pdf/ransomware/Spotlight_Ransomware2021.pdf 2021-02-11
Reported exploitation dl.acm.org /doi/pdf/10.1145/3465481.3465758 2021-08-17
Reported exploitation cisa.gov /sites/default/files/feeds/known_exploited_vulnerabilities.json 2022-05-25
IndexArtifactStarsFirst seen
Exploit-DB Java - 'Statement.invoke()' Trusted Method Chain (Metasploit) 2010-12-15
Metasploit Java Statement.invoke() Trusted Method Chain Privilege Escalation (excellent rank)

Waratek protection

Outside Waratek scope

A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.

  • Protection none
  • Action not pursued none
  • Review automated Upstream data
  • Record active
Decided by Oracle's own risk-matrix note saying the CVE is reached only through untrusted code in the Java sandbox (applets, Web Start) or only through a client installation of Java, so a server running its own trusted code is not exposed
Finding The Java SE CPU Mar 2010 advisory says this vulnerability is reached only through untrusted code running in the Java sandbox, such as an applet or a Web Start application: "May be vulnerable through untrusted Java Web Start applications and Java applets." A server JVM that runs only its own trusted code is not exposed, so there is nothing for the agent to protect.

CVSS

9.8 CRITICAL v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 3 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H NVD Primary published
CVSS 3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CISA-ADP Secondary
CVSS 2.0 7.5 none AV:N/AC:L/Au:N/C:P/I:P/A:P NVD Primary

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Java SE CPU Mar 2010 ↗ CPU 2010-Q1 Java SE and Java for Business / Java Runtime Environment (6 Update 18, 5.0 Update 23, 1.4.2_25)
Oracle's note: May be vulnerable through untrusted Java Web Start applications and Java applets.

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Java SE and Java for Business Java Runtime Environment 6 Update 18, 5.0 Update 23, 1.4.2_25 4.2.25.0 · 5.0.23.0 · 6.0.18.0

Products and versions

3 products, 10 version entries
SourceVendorProductSchemeAffected versions
nvd canonical ubuntu linux generic 8.04 · 8.10 · 9.04 · 9.10
nvd opensuse opensuse generic 11.0 · 11.1 · 11.2
nvd oracle jre javase 1.4.2_25 · 1.5.0:update23 · 1.6.0:update18

References

URLTags
https://access.redhat.com/errata/RHSA-2010:0339 ADVISORY, RHSA-2010:0339
https://access.redhat.com/security/cve/CVE-2010-0840 REPORT, RHSA-2010:0339
http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02273751 Broken Link
http://lists.apple.com/archives/security-announce/2010//May/msg00001.html Mailing List, Third Party Advisory
http://lists.apple.com/archives/security-announce/2010//May/msg00002.html Mailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00001.html Mailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.html Mailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html Mailing List, Third Party Advisory
http://marc.info/?l=bugtraq&m=127557596201693&w=2 Mailing List
http://marc.info/?l=bugtraq&m=134254866602253&w=2 Mailing List

Timeline
Published2010-04-01By the CVE Program.
VulnCheck KEV: earliest evidence2011-07-26Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE.
Added to CISA KEV2022-05-25Listed in CISA's Known Exploited Vulnerabilities catalog.
VulnCheck KEV: latest evidence2022-05-25Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record.
NVD record modified2026-06-16NVD's own last-modified date for this record.