WaratekVRT Sign in

CVE-2013-0431

Affected software2 products, listed below
Affected versions7 Update 11 and before
Severity3.7 Low CVSS 3.1 2 scores
Fixed inJava SE CPU Feb 2013
WeaknessCWE-693
Published31 Jan 2013
Updated2 Oct 2026

Description

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, and OpenJDK 7, allows user-assisted remote attackers to bypass the Java security sandbox via unspecified vectors related to JMX, aka "Issue 52," a different vulnerability than CVE-2013-1490.

Exploitation status

Exploited

Confirmed real-world exploitation.
  • CISA KEV listed Confirmed exploitation in the wild. Added 2022-05-25 · remediation due 2022-06-15 · ransomware use: known
  • VulnCheck KEV listed Exploitation reported in the wild. 4 citations · earliest 2013-03-14.
  • CISA Vulnrichment exploitation: active CISA records active exploitation. Automatable: no, technical impact: partial.
  • Indexed PoC 2 indexed Published artifacts you can open, in Exploit-DB, Metasploit; first seen 2013-02-25.
  • EPSS 90% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.8% of all scored CVEs.

VulnCheck KEV

Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2013-0431 in VulnCheck (free account).

EvidenceSourceDetailDate
Reported exploitation blog.malwarebytes.com /threat-analysis/2013/03/new-exploit-kit-ransomware-and-av-evasion 2013-03-14
Reported exploitation cybersecurityworks.com /pdf/ransomware/Spotlight_Ransomware2021.pdf 2021-02-11
Reported exploitation blog.qualys.com /product-tech/2021/10/05/assess-risk-ransomware-attacks-qualys-research 2021-10-05
Reported exploitation cisa.gov /sites/default/files/feeds/known_exploited_vulnerabilities.json 2022-05-25
IndexArtifactStarsFirst seen
Exploit-DB Java Applet JMX - Remote Code Execution (Metasploit) (2) 2013-02-25
Metasploit Java Applet JMX Remote Code Execution (excellent rank)

Waratek protection

Outside Waratek scope

A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.

  • Protection none
  • Action not pursued none
  • Review human Researcher
  • Record active
Decided by A researcher's recorded decision for this specific CVE
Finding A researcher set this CVE's status to Outside Waratek scope.

Waratek research note

written 2026-11-13

Written by a Waratek engineer who reviewed this CVE. Their decision sets the status above, ahead of every automated rule except a withdrawal.

Java applet / Web Start sandbox escape: needs untrusted code running under the Java sandbox, which a server running trusted code never does.

CVSS

3.7 LOW v3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 3.7 LOW CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N CISA-ADP Secondary published
CVSS 2.0 5.0 none AV:N/AC:L/Au:N/C:N/I:P/A:N NVD Primary

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Java SE CPU Feb 2013 ↗ CPU 2013-Q1 Oracle Java SE / Java Runtime Environment (7 Update 11 and before)
Oracle's note: Applies to client deployment of Java only. This vulnerability can be exploited only through untrusted Java Web Start applications and untrusted Java applets. (Untrusted Java Web Start applications and untrusted applets run in the Java sandbox with limited privileges.)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Java SE Java Runtime Environment 7 Update 11 and before

Products and versions

2 products, 12 version entries
SourceVendorProductSchemeAffected versions
nvd oracle jre javase 1.7.0 · 1.7.0:update1 · 1.7.0:update2 · 1.7.0:update3 · 1.7.0:update4 · 1.7.0:update5 · 1.7.0:update6 · 1.7.0:update7 · 1.7.0:update9 · 1.7.0:update10 · 1.7.0:update11
nvd oracle openjdk javase 7

References

URLTags
https://access.redhat.com/errata/RHSA-2013:0247 ADVISORY, RHSA-2013:0247
https://access.redhat.com/security/cve/CVE-2013-0431 REPORT, RHSA-2013:0247
http://arstechnica.com/security/2013/01/critical-java-vulnerabilies-confirmed-in-latest-version/ Third Party Advisory
http://blogs.computerworld.com/malware-and-vulnerabilities/21693/yet-another-java-security-flaw-discovered-number-53 Not Applicable
http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00001.html Third Party Advisory
http://marc.info/?l=bugtraq&m=136439120408139&w=2 Mailing List, Third Party Advisory
http://marc.info/?l=bugtraq&m=136733161405818&w=2 Mailing List, Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2013-0237.html Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2013-0247.html Third Party Advisory
http://seclists.org/fulldisclosure/2013/Jan/142 Mailing List, Third Party Advisory

Timeline
Published2013-01-31By the CVE Program.
VulnCheck KEV: earliest evidence2013-03-14Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE.
Added to CISA KEV2022-05-25Listed in CISA's Known Exploited Vulnerabilities catalog.
VulnCheck KEV: latest evidence2022-05-25Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record.
Last VRT activity2026-09-29Most recent commit touching this CVE's classification, patch or rule file.
NVD record modified2026-10-02NVD's own last-modified date for this record.
Classification created2026-11-13First commit adding this CVE's research note.