WaratekVRT Sign in

CVE-2013-2423 Oracle JRE

Affected softwareOracle JRE
Affected versions7 Update 17 and before
Severity3.7 Low CVSS 3.1 2 scores
Fixed inJava SE CPU Apr 2013
WeaknessImproper access control (CWE-284)
Published17 Apr 2013
Updated29 Sep 2026

Description

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 7, allows remote attackers to affect integrity via unknown vectors related to HotSpot. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from the original researcher that this vulnerability allows remote attackers to bypass permission checks by the MethodHandles method and modify arbitrary public final fields using reflection and type confusion, as demonstrated using integer and double fields to disable the security manager.

Exploitation status

Exploited

Confirmed real-world exploitation.
  • CISA KEV listed Confirmed exploitation in the wild. Added 2022-05-25 · remediation due 2022-06-15 · ransomware use: unknown
  • VulnCheck KEV listed Exploitation reported in the wild. 6 citations · earliest 2013-05-20.
  • CISA Vulnrichment exploitation: active CISA records active exploitation. Automatable: no, technical impact: partial.
  • Indexed PoC 2 indexed Published artifacts you can open, in Exploit-DB, Metasploit; first seen 2013-04-23.
  • EPSS 85% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.7% of all scored CVEs.

VulnCheck KEV

Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2013-2423 in VulnCheck (free account), which lists 1 more citation not shown here.

EvidenceSourceDetailDate
Reported exploitation fireeye.com /blog/threat-research/2013/05/ready-for-summer-the-sunshop-campaign.html 2013-05-20
Reported exploitation krebsonsecurity.com /2013/07/styx-exploit-pack-domo-arigato-pc-roboto 2013-07-08
Reported exploitation cybersecurityworks.com /pdf/ransomware/Spotlight_Ransomware2021.pdf 2021-02-11
Reported exploitation dl.acm.org /doi/pdf/10.1145/3465481.3465758 2021-08-17
Reported exploitation mandiant.com /sites/default/files/2021-09/rpt-java-vulnerabilities.pdf 2021-09-01
IndexArtifactStarsFirst seen
Exploit-DB Java Applet - Reflection Type Confusion Remote Code Execution (Metasploit) 2013-04-23
Metasploit Java Applet Reflection Type Confusion Remote Code Execution (excellent rank)

Waratek protection

Outside Waratek scope

A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.

  • Protection none
  • Action not pursued none
  • Review human Researcher
  • Record active
Decided by A researcher's recorded decision for this specific CVE
Finding A researcher set this CVE's status to Outside Waratek scope.

Waratek research note

written 2026-11-13

Written by a Waratek engineer who reviewed this CVE. Their decision sets the status above, ahead of every automated rule except a withdrawal.

Java applet / Web Start sandbox escape: needs untrusted code running under the Java sandbox, which a server running trusted code never does.

CVSS

3.7 LOW v3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 3.7 LOW CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N CISA-ADP Secondary published
CVSS 2.0 4.3 none AV:N/AC:M/Au:N/C:N/I:P/A:N NVD Primary

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Java SE CPU Apr 2013 ↗ CPU 2013-Q2 Oracle Java SE / Java Runtime Environment (7 Update 17 and before)
Oracle's note: Applies to client deployment of Java only. This vulnerability can be exploited only through untrusted Java Web Start applications and untrusted Java applets. (Untrusted Java Web Start applications and untrusted applets run in the Java sandbox with limited privileges.)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Java SE Java Runtime Environment 7 Update 17 and before

Products and versions

3 products, 15 version entries
SourceVendorProductSchemeAffected versions
nvd canonical ubuntu linux generic 12.10
nvd opensuse opensuse generic 12.3
nvd oracle jre javase 1.7.0 · 1.7.0:update1 · 1.7.0:update2 · 1.7.0:update3 · 1.7.0:update4 · 1.7.0:update5 · 1.7.0:update6 · 1.7.0:update7 · 1.7.0:update9 · 1.7.0:update10 · 1.7.0:update11 · 1.7.0:update13 · 1.7.0:update15

References

URLTags
https://access.redhat.com/errata/RHSA-2013:0751 ADVISORY, RHSA-2013:0751
https://access.redhat.com/security/cve/CVE-2013-2423 REPORT, RHSA-2013:0751
https://access.redhat.com/errata/RHSA-2013:0752 ADVISORY, RHSA-2013:0752
http://blog.fuseyism.com/index.php/2013/04/22/security-icedtea-2-3-9-for-openjdk-7-released/ Broken Link
http://blog.spiderlabs.com/2013/04/java-is-so-confusing.html Not Applicable
http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/b453d9be6b3f Patch
http://lists.opensuse.org/opensuse-updates/2013-06/msg00099.html Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2013-0752.html Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2013-0757.html Third Party Advisory
http://security.gentoo.org/glsa/glsa-201406-32.xml Third Party Advisory

Timeline
Published2013-04-17By the CVE Program.
VulnCheck KEV: earliest evidence2013-05-20Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE.
Added to CISA KEV2022-05-25Listed in CISA's Known Exploited Vulnerabilities catalog.
VulnCheck KEV: latest evidence2022-05-25Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record.
NVD record modified2026-06-16NVD's own last-modified date for this record.
Last VRT activity2026-09-29Most recent commit touching this CVE's classification, patch or rule file.
Classification created2026-11-13First commit adding this CVE's research note.