Public exploit available

Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2013-2460 — Oracle JDK vulnerability

11 documents10 sources

Severity

9.3CRITICALNVD

EPSS

91.7%

top 0.31%

CISA KEV

Not in KEV

Exploit

PoC available

Public exploit / PoC exists

Affected products

Oracle JDK Oracle JRE

Timeline

PublishedJun 18

Latest updateMay 17

Description

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Serviceability. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "insufficient access checks" in the tra…

CVSS vector

AV:N/AC:M/C:C/I:C/A:CExploitability: 8.6 | Impact: 10.0

Affected Packages2 packages

▶NVDoracle/jdk1.7.0+1

▶NVDoracle/jre1.7.0+1

🔴Vulnerability Details

GHSA

GHSA-fmcw-8c9j-mwj4: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, and OpenJDK 7, allows remote atta↗2022-05-17

▶

VulnCheck

Oracle Java Runtime Environment Insufficient Access Checks Bypass Vulnerability↗2013

▶

💥Exploits & PoCs

Exploit-DB

Java Applet - ProviderSkeleton Insecure Invoke Method (Metasploit)↗2013-07-01

▶

Metasploit

Java Applet ProviderSkeleton Insecure Invoke Method↗

▶

📋Vendor Advisories

Ubuntu

OpenJDK 7 vulnerabilities↗2013-07-16

▶

Ubuntu

IcedTea Web update↗2013-07-16

▶

Red Hat

OpenJDK: tracing insufficient access checks (Serviceability, 8010209)↗2013-06-18

▶

🕵️Threat Intelligence

Zscaler

Dissecting The CVE-2013-2460 Java Exploit | Zscaler Blog↗2014-07-28

▶

Recorded Future

Tracking Moving Targets: Exploit Kits and CVEs↗

▶

💬Community

Bugzilla

CVE-2013-2460 OpenJDK: tracing insufficient access checks (Serviceability, 8010209)↗2013-06-17

▶