CISA KEV · Known exploitedCritical

CVE-2013-0422

Oracle Java Runtime Environment (JRE)

Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using the public getMBeanInstantiator method in the JmxMBeanServer class to obtain a reference to a private MBeanInstantiator object, then retrieving arbitrary Class references using the findClass method, and (2) using the Reflection API with recursion in a way that bypasses a security check by the java.lang.invoke.MethodHandles.Lookup.checkSecurityManager method due to the inability of the sun.reflect.Reflection.getCallerClass method to skip frames related to the new reflectio...

CVSS: 9.8
EPSS: 97.6%
CISA KEV: Listed
Published: 2013.01.11

PRIORITY ASSESSMENT

Immediate review

CISA has listed this vulnerability in the Known Exploited Vulnerabilities catalog.

Known exploitationConfirmed by CISA KEV

Exploit probability97.6%

Technical severityCVSS 9.8

Vulnerability overview

Affected product and versions

Product: Oracle Java Runtime Environment (JRE)
Affected versions: 1.7.0, 12.10, 12.2
Fixed versions: No verified fixed-version field is available yet

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

CISA required action

Apply updates per vendor instructions.

Due date: 2022.06.15

1
Identify
Confirm that Oracle Java Runtime Environment (JRE) and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE: CWE-264, CWE-284
KEV added: 2022.05.25
Ransomware use: 확인됨