Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
cveOracleCVE-2013-2423
HistoryApr 17, 2013 - 6:55 p.m.

CVE-2013-2423

2013-04-1718:55:07
oracle
web.nvd.nist.gov
982
In Wild
2
cve-2013-2423
java runtime environment
jre
oracle
openjdk
remote attackers
integrity
security vulnerability

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

AI Score

8

Confidence

High

EPSS

0.967

Percentile

99.7%

JSON

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 7, allows remote attackers to affect integrity via unknown vectors related to HotSpot. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from the original researcher that this vulnerability allows remote attackers to bypass permission checks by the MethodHandles method and modify arbitrary public final fields using reflection and type confusion, as demonstrated using integer and double fields to disable the security manager.

Affected configurations

Nvd
Node
oraclejreMatch1.7.0-
OR
oraclejreMatch1.7.0update1
OR
oraclejreMatch1.7.0update10
OR
oraclejreMatch1.7.0update11
OR
oraclejreMatch1.7.0update13
OR
oraclejreMatch1.7.0update15
OR
oraclejreMatch1.7.0update2
OR
oraclejreMatch1.7.0update3
OR
oraclejreMatch1.7.0update4
OR
oraclejreMatch1.7.0update5
OR
oraclejreMatch1.7.0update6
OR
oraclejreMatch1.7.0update7
OR
oraclejreMatch1.7.0update9
Node
canonicalubuntu_linuxMatch12.10
OR
opensuseopensuseMatch12.3
VendorProductVersionCPE
oraclejre1.7.0cpe:/a:oracle:jre:1.7.0:update4::
oraclejre1.7.0cpe:/a:oracle:jre:1.7.0:update10::
oraclejre1.7.0cpe:/a:oracle:jre:1.7.0:update3::
oraclejre1.7.0cpe:/a:oracle:jre:1.7.0:update15::
oraclejre1.7.0cpe:/a:oracle:jre:1.7.0:update7::
oraclejre1.7.0cpe:/a:oracle:jre:1.7.0:update5::
oraclejre1.7.0cpe:/a:oracle:jre:1.7.0:update13::
oraclejre1.7.0cpe:/a:oracle:jre:1.7.0:-::
oraclejre1.7.0cpe:/a:oracle:jre:1.7.0:update1::
oraclejre1.7.0cpe:/a:oracle:jre:1.7.0:update11::
Rows per page:
1-10 of 131

References

Social References

More

Related

checkpoint_advisories 3
saint 4
prion 1
cvelist 1
ubuntucve 1
veracode 1
nvd 1
metasploit 1
cisa_kev 1
canvas 1
attackerkb 1
symantec 1
threatpost 3
openvas 21
nessus 27
centos 2
redhat 4
fedora 3
oraclelinux 2
ubuntu 1
amazon 1
securelist 1
ibm 13
securityvulns 1
gentoo 2
checkpoint_advisories
checkpoint_advisories
Java Applet Reflection Type Confusion Remote Code Execution (CVE-2013-2423)
2013-04-28 00:00:00
Oracle Java Final Field Overwrite (CVE-2013-2423)
2013-05-05 00:00:00
Infinity Exploit Kit Landing Page (CVE-2013-1347; CVE-2013-2423; CVE-2013-2465; CVE-2014-0322; CVE-2014-0502; CVE-2014-1776)
2014-06-10 00:00:00
saint
saint
Java Runtime Environment Hotspot final field vulnerability
2013-04-24 00:00:00
Java Runtime Environment Hotspot final field vulnerability
2013-04-24 00:00:00
Java Runtime Environment Hotspot final field vulnerability
2013-04-24 00:00:00
prion
prion
Type confusion
2013-04-17 18:55:00
cvelist
cvelist
CVE-2013-2423
2013-04-17 15:00:00
ubuntucve
ubuntucve
CVE-2013-2423
2013-04-17 00:00:00
veracode
veracode
Permission Check Bypass
2019-05-02 04:44:37
nvd
nvd
CVE-2013-2423
2013-04-17 18:55:07
metasploit
metasploit
Java Applet Reflection Type Confusion Remote Code Execution
2013-04-20 06:43:13
cisa_kev
cisa_kev
Oracle JRE Unspecified Vulnerability
2022-05-25 00:00:00
canvas
canvas
Immunity Canvas: JAVA_DYNAMICBINDING
2013-04-17 18:55:00
attackerkb
attackerkb
CVE-2013-2423
2013-04-17 00:00:00
symantec
symantec
Oracle Java Runtime Environment CVE-2013-2423 Security Bypass Vulnerability
2013-04-16 00:00:00
threatpost
threatpost
65 Sites Compromised in ZeroAccess Trojan Attacks
2013-06-19 16:05:05
IE 8 0Day in Sunshop Targeted Espionage Malware Campaign
2013-05-21 14:40:44
Counter.php Redirecting to Sites Peddling Styx Exploit Kit
2013-08-12 14:52:37
openvas
openvas
Oracle Java SE Multiple Vulnerabilities -03 (May 2013) - Windows
2013-05-06 00:00:00
Oracle Java SE Multiple Vulnerabilities -03 May 13 (Windows)
2013-05-06 00:00:00
Amazon Linux: Security Advisory (ALAS-2013-183)
2015-09-08 00:00:00
nessus
nessus
openSUSE Security Update : java-1_7_0-openjdk (openSUSE-SU-2013:0745-1)
2014-06-13 00:00:00
openSUSE Security Update : java-1_7_0-openjdk (openSUSE-SU-2013:0964-1)
2014-06-13 00:00:00
CentOS 6 : java-1.7.0-openjdk (CESA-2013:0751)
2013-04-19 00:00:00
centos
centos
java security update
2013-04-17 22:33:59
java security update
2013-04-17 21:01:08
redhat
redhat
(RHSA-2013:0751) Critical: java-1.7.0-openjdk security update
2013-04-17 00:00:00
(RHSA-2013:0752) Important: java-1.7.0-openjdk security update
2013-04-17 00:00:00
(RHSA-2013:0822) Critical: java-1.7.0-ibm security update
2013-05-14 00:00:00
fedora
fedora
[SECURITY] Fedora 19 Update: java-1.7.0-openjdk-1.7.0.19-2.3.9.6.fc19
2013-04-25 14:19:39
[SECURITY] Fedora 18 Update: java-1.7.0-openjdk-1.7.0.19-2.3.9.1.fc18
2013-04-18 02:47:29
[SECURITY] Fedora 17 Update: java-1.7.0-openjdk-1.7.0.19-2.3.9.1.fc17
2013-04-19 05:01:04
oraclelinux
oraclelinux
java-1.7.0-openjdk security update
2013-04-17 00:00:00
java-1.7.0-openjdk security update
2013-04-17 00:00:00
ubuntu
ubuntu
OpenJDK 7 vulnerabilities
2013-04-23 00:00:00
amazon
amazon
Critical: java-1.7.0-openjdk
2013-04-18 13:59:00
securelist
securelist
Investigation Report for the September 2014 Equation malware detection incident in the US
2017-11-16 10:00:34
ibm
ibm
Security Bulletin: Information regarding security vulnerability in IBM SDK for Java that is shipped with IBM WebSphere Application Server and addressed by Oracle CPU April 2013 (CVE-2013-0169)
2022-09-25 21:06:56
Security Bulletin: WebSphere Application Server Community Edition 3.0.0.3 Oracle CPU April 2013
2022-09-25 21:06:56
Security Bulletin: IBM WebSphere Lombardi Edition – Information regarding security vulnerability in IBM SDK for Java that shipped with IBM WebSphere Application Server and addressed by Oracle CPU April 2013 (CVE-2013-0169)
2022-09-25 21:06:56
securityvulns
securityvulns
Oracle Java / OpenJDK multiple security vulnerabilities
2013-04-22 00:00:00
gentoo
gentoo
IcedTea JDK: Multiple vulnerabilities
2014-06-29 00:00:00
Oracle JRE/JDK: Multiple vulnerabilities
2014-01-27 00:00:00

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

AI Score

8

Confidence

High

EPSS

0.967

Percentile

99.7%

JSON
Related for CVE-2013-2423
checkpoint_advisories3saint4prion1cvelist1ubuntucve1veracode1nvd1metasploit1cisa_kev1canvas1attackerkb1symantec1threatpost3openvas21nessus27centos2redhat4fedora3oraclelinux2ubuntu1amazon1securelist1ibm13securityvulns1gentoo2