CVE-2013-1488
The Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 6 and 7, allows remote attackers to execute arbitrary...
- Published
- Mar 8, 2013
- Updated
- Aug 6, 2024
- Assigning CNA
- oracle
- Evidence observed
- Jun 11, 2013
Primary CVSS
nvd · CVSS 2.0
AV:N/AC:L/Au:N/C:C/I:C/A:CHigh · next 30 days
- Percentile
- 99.8%
- Model date
- Oct 14, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Summary
The Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 6 and 7, allows remote attackers to execute arbitrary code via unspecified vectors involving reflection, Libraries, "improper toString calls," and the JDBC driver manager, as demonstrated by James Forshaw during a Pwn2Own competition at CanSecWest 2013.
Sources
modules/exploits/multi/browser/java_jre17_driver_manager.rb
Metasploit Framework modulesDeclared conditions
- platform: Java,Linux,OSX,Windows($.exploit_multi/browser/java_jre17_driver_manager.platform)
- verification: check_not_declared($.exploit_multi/browser/java_jre17_driver_manager.check)
PoC Java exploit based on http://www.contextis.com/research/blog/java-pwn2own/
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.