4.3

CVE-2013-2423: Oracle JRE Unspecified Vulnerability

CVSS: 4.3v2.0MediumKEVAnalyzed
Published 17-04-2013Last modified 22-10-2025
Open JSON

Vulnerability summary

CVE-2013-2423 is a medium (CVSS 4.3) Improper Access Control vulnerability in Oracle Java Runtime Environment (JRE). It is known to be exploited: CISA lists it, first on 25-05-2022. EPSS estimates a 85.22% chance of exploitation in the next 30 days, higher than 99.7% of scored vulnerabilities. 2 public exploits are recorded.

Overall risk
85/100
0100
Critical · default modelHow is this calculated?
CVSS score
4.3/10
010
Medium · v2.0 (NVD)
EPSS score
85.22%
0%100%
Critical · 0.00 pp in 30 days
KEVListedCISA
RansomwareNone recordedNo known use recorded
Public exploits2exploit-database, metasploit

Advisory lineage

Upstream 0 · Downstream 5 · Related 1
OPENSUSE-SU-2024:10534-1RHSA-2013:0751RHSA-2013:0752RHSA-2013:0757RHSA-2013:0822

Timeline

  1. 17-04-2013
    PublishedVulnerability first disclosed.
  2. 25-05-2022
    Added to CISA KEVOracle JRE Unspecified Vulnerability
  3. 15-06-2022
    CISA remediation dueApply updates per vendor instructions.
  4. 22-10-2025
    Last modifiedVulnerability information updated.

Description

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 7, allows remote attackers to affect integrity via unknown vectors related to HotSpot. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from the original researcher that this vulnerability allows remote attackers to bypass permission checks by the MethodHandles method and modify arbitrary public final fields using reflection and type confusion, as demonstrated using integer and double fields to disable the security manager.

CVSS metrics

3 scores · 2 sources · 2 versions

EPSS trend

Probability

85.22%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

0.00 pp

From 85.22% on 20-09-2026

20-09-202620-10-2026
EPSS score
85.22%

Known exploited

Compare KEV catalogs
CISA KEVListed
Added
25-05-2022
Federal due date
15-06-2022

CISA required action

Apply updates per vendor instructions. nvd.nist.gov/vuln/detail/CVE-2013-2423

Public exploits

2 found
  • exploit-databaseremotemultipleVerified

    Java Applet - Reflection Type Confusion Remote Code Execution (Metasploit)

    Maturity: weaponized

  • MetasploitMetasploitremoteVerified

    Java Applet Reflection Type Confusion Remote Code Execution

    exploit/multi/browser/java_jre17_reflection_types

    Maturity: weaponized

Weaknesses

CWE · root cause

Affected systems

Canonical1 product
Opensuse1 product
Oracle1 product
  • jre1.7.0 | 1.7.0:update1 | 1.7.0:update10 | 1.7.0:update11 | 1.7.0:update13 | 1.7.0:update15 | 1.7.0:update2 | 1.7.0:update3 | 1.7.0:update4 | 1.7.0:update5 | 1.7.0:update6 | 1.7.0:update7 | 1.7.0:update9

3 vendors · 3 products

References

17 links
Show all 17 references