CVE-2013-2423: oracle jre +2 lainnya

csirt@kutim:~/threat-intel/cve/CVE-2013-2423

CVSS 3.7 · Low KEV · sudah dieksploitasi EPSS 85,2%

Kerentanan Improper Access Control pada oracle jre, canonical ubuntu linux +1 lainnya. Skor CVSS 3.1 3.7 (Low) menurut CISA ADP. Masuk katalog KEV CISA pada 25 Mei 2022, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 7, allows remote attackers to affect integrity via unknown vectors related to HotSpot. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from the original researcher that this vulnerability allows remote attackers to bypass permission checks by the MethodHandles method and modify arbitrary public final fields using reflection and type confusion, as demonstrated using integer and double fields to disable the security manager.

Rincian

Terbit di NVD: 17 April 2013
Terakhir diubah: 16 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 3.7 (Low), sumber CISA ADP
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-284: Improper Access Control
EPSS (30 hari): 85,2% peluang dieksploitasi; lebih tinggi dari 99,7% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama: Oracle JRE Unspecified Vulnerability
Masuk KEV: 25 Mei 2022
Tenggat CISA: 15 Juni 2022 (untuk instansi federal AS)
Ransomware: Belum tercatat
Tindakan wajib: Apply updates per vendor instructions.

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
oracle	jre	Versi 1.7.0
oracle	jre	Versi 1.7.0 update1
oracle	jre	Versi 1.7.0 update10
oracle	jre	Versi 1.7.0 update11
oracle	jre	Versi 1.7.0 update13
oracle	jre	Versi 1.7.0 update15
oracle	jre	Versi 1.7.0 update2
oracle	jre	Versi 1.7.0 update3
oracle	jre	Versi 1.7.0 update4
oracle	jre	Versi 1.7.0 update5
oracle	jre	Versi 1.7.0 update6
oracle	jre	Versi 1.7.0 update7
oracle	jre	Versi 1.7.0 update9
canonical	ubuntu linux	Versi 12.10
opensuse	opensuse	Versi 12.3

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html advisory vendor
http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/b453d9be6b3f patch
http://www.us-cert.gov/ncas/alerts/TA13-107A advisory pihak ketiga · pemerintah AS
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-2423 pemerintah AS
http://lists.opensuse.org/opensuse-updates/2013-06/msg00099.html advisory pihak ketiga
http://rhn.redhat.com/errata/RHSA-2013-0752.html advisory pihak ketiga
http://rhn.redhat.com/errata/RHSA-2013-0757.html advisory pihak ketiga
http://security.gentoo.org/glsa/glsa-201406-32.xml advisory pihak ketiga
http://www.exploit-db.com/exploits/24976 advisory pihak ketiga · vdb entry
http://www.mandriva.com/security/advisories?name=MDVSA-2013:161 advisory pihak ketiga
http://www.ubuntu.com/usn/USN-1806-1 advisory pihak ketiga
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0130 advisory pihak ketiga
http://blog.fuseyism.com/index.php/2013/04/22/security-icedtea-2-3-9-for-openjdk-7-released/ broken link
http://blog.spiderlabs.com/2013/04/java-is-so-confusing.html not applicable
http://weblog.ikvm.net/PermaLink.aspx?guid=acd2dd6d-1028-4996-95df-efa42ac237f0 broken link
https://bugzilla.redhat.com/show_bug.cgi?id=952398 issue tracking
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16700 broken link

Sumber: NVD · CVE.org · KEV CISA · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.