CVE-2013-1488

Advisory lineage Upstream: 0 Downstream: 6
Modified
Published: 08 Mar 2013, 18:00
Last modified:06 Aug 2024, 15:04

Vulnerability Summary

Overall Risk (default)
critical
90/100
CVSS Score
10 HIGH
v2.0 (nvd)
EPSS Score
86.25% CRITICAL
86% probability -5.34%
KEV
Not listed
Ransomware
No reports
Public exploits
2 found
Dark Web
Not detected

Timeline

08 Mar 2013, 18:00
Published
Vulnerability first disclosed
06 Aug 2024, 15:04
Last Modified
Vulnerability information updated

Description

The Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 6 and 7, allows remote attackers to execute arbitrary code via unspecified vectors involving reflection, Libraries, "improper toString calls," and the JDBC driver manager, as demonstrated by James Forshaw during a Pwn2Own competition at CanSecWest 2013.

CVSS Metrics

  • v2.0•HIGH•Score: 10AV:N/AC:L/Au:N/C:C/I:C/A:C

EPSS Trends

Current EPSS score: 86.25%• Percentile: 99%

Techniques & Countermeasures

  • CWE-94•Improper Control of Generation of Code ('Code Injection')

    The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Affected Systems

  • oracle•jdk

    1.7.0:update17

  • oracle•jre

    1.7.0:update17

References (22)