CVE-2011-3544: Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability

KEV

Analyzed

AliasesCGA-3fpm-5645-rxj9CGA-7h2v-6q3w-562vCGA-f768-wvr6-v4pp+5 more

Published 19-10-2011Last modified 22-10-2025

Vulnerability summary

CVE-2011-3544 is a high (CVSS 10.0) Improper Access Control vulnerability in Oracle Java SE JDK and JRE. It is known to be exploited: CISA lists it, first on 03-03-2022. EPSS estimates a 96.65% chance of exploitation in the next 30 days, higher than 99.8% of scored vulnerabilities. 2 public exploits are recorded.

Priority

Act nowlisted as exploited

Listed as exploited by CISA (03-03-2022)

Source freshness unavailable

How is this decided?

CVSS score

10.0/10

010

High · v2.0 (NVD)

EPSS score

96.65%

0%100%

Critical · 0.00 pp in 30 days

KEVExploited in the wildCritical · listed in 1 catalog

RansomwareNot flaggedNo ransomware use recorded.

Public exploits2exploit-database, metasploit

Advisory lineage

Upstream 0 · Downstream 7 · Related 3

DSA-2356-1 DSA-2358-1 RHSA-2011:1380 RHSA-2011:1384 RHSA-2012:0034 RHSA-2012:1467+4 more

Timeline

19-10-2011
PublishedVulnerability first disclosed.
03-03-2022
Added to CISA KEVExploitedOracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability
24-03-2022
CISA remediation dueDeadline passedApply updates per vendor instructions.
22-10-2025
Last modifiedVulnerability information updated.

Description

Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7 and 6 Update 27 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability via unknown vectors related to Scripting.

CVSS metrics

3 scores · 2 sources · 2 versions

v3.19.8v2.010.0

EPSS trend

Probability

96.65%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

No change 0.00 pp

From 96.65% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEVListed

Added: 03-03-2022
Federal due date: 24-03-2022

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

CISA required action

Apply updates per vendor instructions. nvd.nist.gov/vuln/detail/CVE-2011-3544

Public exploits

2 found

exploit-databaseremotemultipleVerified
Java Applet Rhino Script Engine - Remote Code Execution (Metasploit)
Maturity: weaponized
MetasploitremoteVerified
Java Applet Rhino Script Engine Remote Code Execution
exploit/multi/browser/java_rhino
Maturity: weaponized

Weaknesses

CWE · root cause

CWE-284Improper Access ControlThe product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard4 products

openjdk-11-openj9-default-policy< 0.53.0-r0
openjdk-17-openj9-default-policy< 0.53.0-r0
openjdk-21-openj9-default-policy< 0.48.0-r2
openjdk-8-openj9-dbg< 0.53.0-r1

Oracle2 products

jdk< 1.6.0 | 1.6.0 | 1.6.0:update1 | 1.6.0:update10 | 1.6.0:update11 | 1.6.0:update12 | 1.6.0:update13 | 1.6.0:update14 | 1.6.0:update15 | 1.6.0:update16 | 1.6.0:update17 | 1.6.0:update18 | 1.6.0:update19 | 1.6.0:update2 | 1.6.0:update20 | 1.6.0:update21 | 1.6.0:update22 | 1.6.0:update23 | 1.6.0:update24 | 1.6.0:update25 | 1.6.0:update26 | 1.7.0 | 1.7.0:update1 | 1.7.0:update10 | 1.7.0:update11 | 1.7.0:update13 | 1.7.0:update15 | 1.7.0:update17 | 1.7.0:update2 | 1.7.0:update21 | 1.7.0:update25 | 1.7.0:update3 | 1.7.0:update4 | 1.7.0:update5 | 1.7.0:update6 | 1.7.0:update7 | 1.7.0:update7_b32 | 1.7.0:update9 | 1.7.0:update9_b31 | 1.7.0:update9_b32
jre< 1.6.0 | 1.6.0 | 1.6.0:update1 | 1.6.0:update11 | 1.6.0:update12 | 1.6.0:update13 | 1.6.0:update14 | 1.6.0:update15 | 1.6.0:update16 | 1.6.0:update17 | 1.6.0:update18 | 1.6.0:update19 | 1.6.0:update2 | 1.6.0:update20 | 1.6.0:update21 | 1.6.0:update22 | 1.6.0:update23 | 1.6.0:update24 | 1.6.0:update25 | 1.6.0:update26 | 1.6.0:update3 | 1.6.0:update4 | 1.6.0:update5 | 1.6.0:update6 | 1.6.0:update7 | 1.6.0:update8 | 1.6.0:update9 | 1.7.0 | 1.7.0:update1 | 1.7.0:update10 | 1.7.0:update10_b31 | 1.7.0:update11 | 1.7.0:update13 | 1.7.0:update15 | 1.7.0:update17 | 1.7.0:update17_b31 | 1.7.0:update17_b32 | 1.7.0:update2 | 1.7.0:update21 | 1.7.0:update21_b31 | 1.7.0:update25 | 1.7.0:update25_b33 | 1.7.0:update25_b34 | 1.7.0:update25_b35 | 1.7.0:update3 | 1.7.0:update4 | 1.7.0:update5 | 1.7.0:update6 | 1.7.0:update7 | 1.7.0:update7_b32 | 1.7.0:update9

Suse2 products

linux_enterprise_java10:sp4
linux_enterprise_server10:sp4

Canonical1 product

ubuntu_linuxEOL10.04 | 10.10 | 11.04 | 11.10

Redhat1 product

satellite_with_embedded_oracle5.4

5 vendors · 10 products

References

16 links

oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13947VDB EntrySignatureX Refsource OVALBroken Link
security.gentoo.org/glsa/glsa-201406-32.xmlVendor AdvisoryX Refsource GENTOOThird Party Advisory
marc.info?l=bugtraq&m=134254866602253&w=2Vendor AdvisoryX Refsource HPMailing List
secunia.com/advisories/48308Third Party AdvisoryX Refsource SECUNIABroken Link
marc.info?l=bugtraq&m=132750579901589&w=2Vendor AdvisoryX Refsource HPMailing List
lists.opensuse.org/opensuse-security-announce/2012-01/msg00049.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
rhn.redhat.com/errata/RHSA-2013-1455.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
www.redhat.com/support/errata/RHSA-2011-1384.htmlVendor AdvisoryX Refsource REDHATBroken Link
www.securityfocus.com/bid/50218VDB EntryX Refsource BIDBroken LinkThird Party Advisory
www.oracle.com/technetwork/topics/security/javacpuoct2011-443431.htmlX Refsource CONFIRMPatchVendor Advisory

Show all 16 references

marc.info?l=bugtraq&m=134254957702612&w=2Vendor AdvisoryX Refsource HPMailing List
exchange.xforce.ibmcloud.com/vulnerabilities/70849VDB EntryX Refsource XFThird Party Advisory
www.securitytracker.com/id?1026215VDB EntryX Refsource SECTRACKBroken LinkThird Party Advisory
www.ubuntu.com/usn/USN-1263-1Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
www.ibm.com/developerworks/java/jdk/alerts/X Refsource CONFIRMProduct
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2011-3544Government ResourceUS Government Resource