{"cve":{"cve_id":"CVE-2013-0431","is_kev":true,"kev_date_added":"2022-05-25","kev_vendor_project":"Oracle","kev_product":"Java Runtime Environment (JRE)","kev_vulnerability_name":"Oracle JRE Sandbox Bypass Vulnerability","kev_short_description":"Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle allows remote attackers to bypass the Java security sandbox.","kev_required_action":"Apply updates per vendor instructions.","kev_due_date":"2022-06-15","kev_known_ransomware":true,"kev_notes":"https://nvd.nist.gov/vuln/detail/CVE-2013-0431","kev_cwes":[],"epss_score":0.9015,"epss_percentile":0.99798,"epss_as_of":"2026-10-15","description":"Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, and OpenJDK 7, allows user-assisted remote attackers to bypass the Java security sandbox via unspecified vectors related to JMX, aka \"Issue 52,\" a different vulnerability than CVE-2013-1490.","published_at":"2013-01-31T14:10:00Z","last_modified_at":"2026-10-02T14:55:14.407000Z","cvss_v3_score":5.3,"cvss_v3_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_v3_severity":"MEDIUM","cvss_v4_score":null,"cvss_v4_vector":null,"cvss_v4_severity":null,"ssvc_decision":null,"ssvc_exploitation":"active","ssvc_automatable":true,"ssvc_technical_impact":"partial","cwes":["CWE-693"],"nvd_references":["https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19418","http://security.gentoo.org/glsa/glsa-201406-32.xml","http://www.mandriva.com/security/advisories?name=MDVSA-2013:095","http://www.informationweek.com/security/application-security/java-hacker-uncovers-two-flaws-in-latest/240146717","http://www.us-cert.gov/cas/techalerts/TA13-032A.html","http://seclists.org/fulldisclosure/2013/Jan/142","http://www.kb.cert.org/vuls/id/858729","http://rhn.redhat.com/errata/RHSA-2013-0237.html","http://marc.info/?l=bugtraq&m=136439120408139&w=2","http://rhn.redhat.com/errata/RHSA-2013-0247.html","http://arstechnica.com/security/2013/01/critical-java-vulnerabilies-confirmed-in-latest-version/","http://seclists.org/fulldisclosure/2013/Jan/195","http://marc.info/?l=bugtraq&m=136733161405818&w=2","http://marc.info/?l=bugtraq&m=136439120408139&w=2","http://blogs.computerworld.com/malware-and-vulnerabilities/21693/yet-another-java-security-flaw-discovered-number-53","http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00001.html","http://www.securityfocus.com/archive/1/525387/30/0/threaded","https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16579","http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html","http://marc.info/?l=bugtraq&m=136733161405818&w=2","https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0056"],"vuln_status":"Analyzed","trending_score":null,"is_trending":false,"has_trended":true,"trended_number_one":false,"trending_peak_score":0.6424266000000001,"trending_peak_rank":3,"started_trending_at":"2026-08-16T00:38:47.790255Z","trended_number_one_at":null,"summary_generated":null,"summary_generated_at":null,"summary_model":null,"created_at":"2026-06-24T00:09:31.350578Z","updated_at":"2026-10-10T15:40:11.563370Z"},"effective_severity":"MEDIUM","badges":["kev","ransomware","exploit","epss"],"impact_analysis":[],"cvss_v3_decoded":{"version":"3.1","metrics":[{"metric":"AV","name":"Attack Vector","value":"N","value_label":"Network"},{"metric":"AC","name":"Attack Complexity","value":"L","value_label":"Low"},{"metric":"PR","name":"Privileges Required","value":"N","value_label":"None"},{"metric":"UI","name":"User Interaction","value":"N","value_label":"None"},{"metric":"S","name":"Scope","value":"U","value_label":"Unchanged"},{"metric":"C","name":"Confidentiality","value":"L","value_label":"Low"},{"metric":"I","name":"Integrity","value":"N","value_label":"None"},{"metric":"A","name":"Availability","value":"N","value_label":"None"}]},"cvss_v4_decoded":{"version":null,"metrics":[]},"affected":[{"vendor_slug":"oracle","vendor_name":"oracle","product_slug":"jre","product_name":"jre","version_start":"1.7.0","version_start_inclusive":true,"version_end":"1.7.0","version_end_inclusive":true,"cpe23_uri":"cpe:2.3:a:oracle:jre:1.7.0:-:*:*:*:*:*:*"},{"vendor_slug":"oracle","vendor_name":"oracle","product_slug":"jre","product_name":"jre","version_start":"1.7.0","version_start_inclusive":true,"version_end":"1.7.0","version_end_inclusive":true,"cpe23_uri":"cpe:2.3:a:oracle:jre:1.7.0:update1:*:*:*:*:*:*"},{"vendor_slug":"oracle","vendor_name":"oracle","product_slug":"jre","product_name":"jre","version_start":"1.7.0","version_start_inclusive":true,"version_end":"1.7.0","version_end_inclusive":true,"cpe23_uri":"cpe:2.3:a:oracle:jre:1.7.0:update10:*:*:*:*:*:*"},{"vendor_slug":"oracle","vendor_name":"oracle","product_slug":"jre","product_name":"jre","version_start":"1.7.0","version_start_inclusive":true,"version_end":"1.7.0","version_end_inclusive":true,"cpe23_uri":"cpe:2.3:a:oracle:jre:1.7.0:update11:*:*:*:*:*:*"},{"vendor_slug":"oracle","vendor_name":"oracle","product_slug":"jre","product_name":"jre","version_start":"1.7.0","version_start_inclusive":true,"version_end":"1.7.0","version_end_inclusive":true,"cpe23_uri":"cpe:2.3:a:oracle:jre:1.7.0:update2:*:*:*:*:*:*"},{"vendor_slug":"oracle","vendor_name":"oracle","product_slug":"jre","product_name":"jre","version_start":"1.7.0","version_start_inclusive":true,"version_end":"1.7.0","version_end_inclusive":true,"cpe23_uri":"cpe:2.3:a:oracle:jre:1.7.0:update3:*:*:*:*:*:*"},{"vendor_slug":"oracle","vendor_name":"oracle","product_slug":"jre","product_name":"jre","version_start":"1.7.0","version_start_inclusive":true,"version_end":"1.7.0","version_end_inclusive":true,"cpe23_uri":"cpe:2.3:a:oracle:jre:1.7.0:update4:*:*:*:*:*:*"},{"vendor_slug":"oracle","vendor_name":"oracle","product_slug":"jre","product_name":"jre","version_start":"1.7.0","version_start_inclusive":true,"version_end":"1.7.0","version_end_inclusive":true,"cpe23_uri":"cpe:2.3:a:oracle:jre:1.7.0:update5:*:*:*:*:*:*"},{"vendor_slug":"oracle","vendor_name":"oracle","product_slug":"jre","product_name":"jre","version_start":"1.7.0","version_start_inclusive":true,"version_end":"1.7.0","version_end_inclusive":true,"cpe23_uri":"cpe:2.3:a:oracle:jre:1.7.0:update6:*:*:*:*:*:*"},{"vendor_slug":"oracle","vendor_name":"oracle","product_slug":"jre","product_name":"jre","version_start":"1.7.0","version_start_inclusive":true,"version_end":"1.7.0","version_end_inclusive":true,"cpe23_uri":"cpe:2.3:a:oracle:jre:1.7.0:update7:*:*:*:*:*:*"},{"vendor_slug":"oracle","vendor_name":"oracle","product_slug":"jre","product_name":"jre","version_start":"1.7.0","version_start_inclusive":true,"version_end":"1.7.0","version_end_inclusive":true,"cpe23_uri":"cpe:2.3:a:oracle:jre:1.7.0:update9:*:*:*:*:*:*"},{"vendor_slug":"oracle","vendor_name":"oracle","product_slug":"openjdk","product_name":"openjdk","version_start":"7","version_start_inclusive":true,"version_end":"7","version_end_inclusive":true,"cpe23_uri":"cpe:2.3:a:oracle:openjdk:7:-:*:*:*:*:*:*"}],"exploit_refs":[{"source":"exploit-db","kind":"exploit-db","url":"https://www.exploit-db.com/exploits/24539","title":"Java Applet JMX - Remote Code Execution (Metasploit) (2)","author":"Metasploit","disclosed_at":"2013-02-25"}],"news":[],"references":[{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19418","source_type":"MISC","tags":[]},{"url":"http://security.gentoo.org/glsa/glsa-201406-32.xml","source_type":"MISC","tags":[]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2013:095","source_type":"VENDOR_ADVISORY","tags":["advisory"]},{"url":"http://www.informationweek.com/security/application-security/java-hacker-uncovers-two-flaws-in-latest/240146717","source_type":"MISC","tags":[]},{"url":"http://www.us-cert.gov/cas/techalerts/TA13-032A.html","source_type":"MISC","tags":[]},{"url":"http://seclists.org/fulldisclosure/2013/Jan/142","source_type":"MAILING_LIST","tags":["mailing-list"]},{"url":"http://www.kb.cert.org/vuls/id/858729","source_type":"MISC","tags":[]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0237.html","source_type":"MISC","tags":[]},{"url":"http://marc.info/?l=bugtraq&m=136439120408139&w=2","source_type":"MAILING_LIST","tags":["mailing-list"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0247.html","source_type":"MISC","tags":[]},{"url":"http://arstechnica.com/security/2013/01/critical-java-vulnerabilies-confirmed-in-latest-version/","source_type":"MISC","tags":[]},{"url":"http://seclists.org/fulldisclosure/2013/Jan/195","source_type":"MAILING_LIST","tags":["mailing-list"]},{"url":"http://marc.info/?l=bugtraq&m=136733161405818&w=2","source_type":"MAILING_LIST","tags":["mailing-list"]},{"url":"http://marc.info/?l=bugtraq&m=136439120408139&w=2","source_type":"MAILING_LIST","tags":["mailing-list"]},{"url":"http://blogs.computerworld.com/malware-and-vulnerabilities/21693/yet-another-java-security-flaw-discovered-number-53","source_type":"MISC","tags":[]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00001.html","source_type":"MAILING_LIST","tags":["mailing-list"]},{"url":"http://www.securityfocus.com/archive/1/525387/30/0/threaded","source_type":"MISC","tags":[]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16579","source_type":"MISC","tags":[]},{"url":"http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html","source_type":"VENDOR_ADVISORY","tags":["advisory"]},{"url":"http://marc.info/?l=bugtraq&m=136733161405818&w=2","source_type":"MAILING_LIST","tags":["mailing-list"]},{"url":"https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0056","source_type":"VENDOR_ADVISORY","tags":["advisory"]}],"timeline":[{"type":"published","at":"2013-01-31T14:10:00Z","label":"CVE published","source":null},{"type":"exploit_known","at":"2013-02-25T00:00:00Z","label":"Public exploit available","source":"exploit-db"},{"type":"cisa_reported","at":"2022-05-25T00:00:00Z","label":"Added to CISA KEV catalog","source":"kev"},{"type":"ssvc_changed","at":"2026-06-24T00:31:01.449015Z","label":"SSVC decision revised","source":"vulnrichment"},{"type":"ssvc_changed","at":"2026-06-24T00:31:01.449015Z","label":"SSVC decision revised","source":"vulnrichment"},{"type":"ssvc_changed","at":"2026-06-24T00:31:01.449015Z","label":"SSVC decision revised","source":"vulnrichment"},{"type":"cvss_changed","at":"2026-06-24T00:31:01.449015Z","label":"CVSS score revised","source":"vulnrichment"},{"type":"cvss_changed","at":"2026-06-24T00:31:01.449015Z","label":"CVSS score revised","source":"vulnrichment"},{"type":"cvss_changed","at":"2026-06-24T00:31:01.449015Z","label":"CVSS score revised","source":"vulnrichment"},{"type":"started_trending","at":"2026-08-16T00:38:47.790255Z","label":"Started trending","source":null}]}