CVE-2013-0431: oracle jre +1 lainnya

csirt@kutim:~/threat-intel/cve/CVE-2013-0431

CVSS 3.7 · Low KEV · sudah dieksploitasi Dipakai ransomware EPSS 90,1%

Kerentanan Protection Mechanism Failure pada oracle jre, oracle openjdk. Skor CVSS 3.1 3.7 (Low) menurut CISA ADP. Masuk katalog KEV CISA pada 25 Mei 2022, artinya sudah terbukti dieksploitasi. Tercatat dipakai dalam kampanye ransomware.

Deskripsi (NVD)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, and OpenJDK 7, allows user-assisted remote attackers to bypass the Java security sandbox via unspecified vectors related to JMX, aka "Issue 52," a different vulnerability than CVE-2013-1490.

Rincian

Terbit di NVD: 31 Januari 2013
Terakhir diubah: 2 Oktober 2026
Status NVD: Analyzed
CVSS 3.1: 3.7 (Low), sumber CISA ADP
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-693: Protection Mechanism Failure
EPSS (30 hari): 90,1% peluang dieksploitasi; lebih tinggi dari 99,7% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama: Oracle JRE Sandbox Bypass Vulnerability
Masuk KEV: 25 Mei 2022
Tenggat CISA: 15 Juni 2022 (untuk instansi federal AS)
Ransomware: Tercatat dipakai dalam kampanye ransomware
Tindakan wajib: Apply updates per vendor instructions.

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
oracle	jre	Versi 1.7.0
oracle	jre	Versi 1.7.0 update1
oracle	jre	Versi 1.7.0 update10
oracle	jre	Versi 1.7.0 update11
oracle	jre	Versi 1.7.0 update2
oracle	jre	Versi 1.7.0 update3
oracle	jre	Versi 1.7.0 update4
oracle	jre	Versi 1.7.0 update5
oracle	jre	Versi 1.7.0 update6
oracle	jre	Versi 1.7.0 update7
oracle	jre	Versi 1.7.0 update9
oracle	openjdk	Versi 7

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html advisory vendor
http://www.kb.cert.org/vuls/id/858729 advisory pihak ketiga · pemerintah AS
http://www.us-cert.gov/cas/techalerts/TA13-032A.html advisory pihak ketiga · pemerintah AS
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-0431 pemerintah AS
http://arstechnica.com/security/2013/01/critical-java-vulnerabilies-confirmed-in-latest-version/ advisory pihak ketiga
http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00001.html advisory pihak ketiga
http://marc.info/?l=bugtraq&m=136439120408139&w=2 mailing list · advisory pihak ketiga
http://marc.info/?l=bugtraq&m=136733161405818&w=2 mailing list · advisory pihak ketiga
http://rhn.redhat.com/errata/RHSA-2013-0237.html advisory pihak ketiga
http://rhn.redhat.com/errata/RHSA-2013-0247.html advisory pihak ketiga
http://seclists.org/fulldisclosure/2013/Jan/142 mailing list · advisory pihak ketiga
http://seclists.org/fulldisclosure/2013/Jan/195 mailing list · advisory pihak ketiga
http://security.gentoo.org/glsa/glsa-201406-32.xml advisory pihak ketiga
http://www.securityfocus.com/archive/1/525387/30/0/threaded advisory pihak ketiga · vdb entry
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0056 advisory pihak ketiga
http://blogs.computerworld.com/malware-and-vulnerabilities/21693/yet-another-java-security-flaw-discovered-num... not applicable
http://www.informationweek.com/security/application-security/java-hacker-uncovers-two-flaws-in-latest/24014671... broken link
http://www.mandriva.com/security/advisories?name=MDVSA-2013:095 not applicable
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16579 broken link
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19418 broken link

Sumber: NVD · CVE.org · KEV CISA · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.