Vulnerability Details : CVE-2013-2423

Public exploit exists!
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 7, allows remote attackers to affect integrity via unknown vectors related to HotSpot. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from the original researcher that this vulnerability allows remote attackers to bypass permission checks by the MethodHandles method and modify arbitrary public final fields using reflection and type confusion, as demonstrated using integer and double fields to disable the security manager.
Published 2013-04-17 18:55:07
Updated 2017-09-19 01:36:17
Source Oracle
View at NVD,   CVE.org

Threat overview for CVE-2013-2423

Top countries where our scanners detected CVE-2013-2423
Top open port discovered on systems with this issue 80
IPs affected by CVE-2013-2423 78
Threat actors abusing to this issue? Yes
Find out if you* are affected by CVE-2013-2423!
*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

CVE-2013-2423 is in the CISA Known Exploited Vulnerabilities Catalog

CISA vulnerability name:
Oracle JRE Unspecified Vulnerability
CISA required action:
Apply updates per vendor instructions.
CISA description:
Unspecified vulnerability in hotspot for Java Runtime Environment (JRE) allows remote attackers to affect integrity.
Added on 2022-05-25 Action due date 2022-06-15

Exploit prediction scoring system (EPSS) score for CVE-2013-2423

Probability of exploitation activity in the next 30 days: 97.50%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 100 % EPSS Score History EPSS FAQ

Metasploit modules for CVE-2013-2423

  • Java Applet Reflection Type Confusion Remote Code Execution
    Disclosure Date: 2013-01-10
    First seen: 2020-04-26
    exploit/multi/browser/java_jre17_reflection_types
    This module abuses Java Reflection to generate a Type Confusion, due to a weak access control when setting final fields on static classes, and run code outside of the Java Sandbox. The vulnerability affects Java version 7u17 and earlier. This exploit bypasses click

CVSS scores for CVE-2013-2423

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source
4.3
 MEDIUM AV:N/AC:M/Au:N/C:N/I:P/A:N
8.6
2.9
 NIST

References for CVE-2013-2423

Products affected by CVE-2013-2423

This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!
Accept Close