⚠ Actively exploited in ransomware campaigns
This vulnerability is on the CISA Known Exploited Vulnerabilities list and has been used in known ransomware attacks. CISA required action: Apply updates per vendor instructions.. Due date: 2022-03-24.

CVE-2012-1723

CWE-284 — Improper Access Control12 documents10 sources
Severity
9.8CRITICAL
EPSS
94.1%
top 0.09%
CISA KEV
KEVRansomware
Added 2022-03-03
Due 2022-03-24
Exploit
Exploited in wild
Active exploitation observed
Affected products
8
Redhat Icedtea6Oracle JDKOracle JRE+5 more
Timeline
PublishedJun 16
KEV addedMar 3
KEV dueMar 24
Latest updateMay 14
CISA Required Action: Apply updates per vendor instructions.

Description

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.2_37 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages6 packages

▶NVDoracle/jdk1.4.2_37+3
▶NVDoracle/jre1.4.2_37+3
▶NVDredhat/icedtea61.11.0 — 1.11.3+1

Also affects: Enterprise Linux 6.2

🔴Vulnerability Details

3
GHSA
GHSA-ch9c-pq9h-jrr9: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update↗2022-05-14
▶
CVEList
CVE-2012-1723: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update↗2012-06-16
▶
VulnCheck
Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability↗2012
▶

💥Exploits & PoCs

1
Exploit-DB
Java Applet - Field Bytecode Verifier Cache Remote Code Execution (Metasploit)↗2012-07-11
▶

📋Vendor Advisories

3
CISA
Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability↗2022-03-03
▶
Ubuntu
OpenJDK 6 vulnerabilities↗2012-07-13
▶
Red Hat
OpenJDK: insufficient field accessibility checks (HotSpot, 7152811)↗2012-06-12
▶

🕵️Threat Intelligence

2
Talos
CVE-2012-1723: New Java Attack Added to Blackhole↗2012-07-09
▶
Talos
CVE-2012-1723: New Java Attack Added to Blackhole↗2012-07-09
▶

💬Community

2
Bugzilla
Blocklist Java versions affected by CVE-2012-1723↗2012-08-06
▶
Bugzilla
CVE-2012-1723 OpenJDK: insufficient field accessibility checks (HotSpot, 7152811)↗2012-06-06
▶
CVE-2012-1723 (CRITICAL CVSS 9.8) | Unspecified vulnerability in the Ja | cvebase.io