CVE-2013-2423
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7...
4.3 MediumIn KEVPublic exploit
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 7, allows remote attackers to affect integrity via unknown vectors related to HotSpot. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from the original researcher that this vulnerability allows remote attackers to bypass permission checks by the MethodHandles method and modify arbitrary public final fields using reflection and type confusion, as demonstrated using integer and double fields to disable the security manager.
Exploit likelihood
85.2%Up 2.2 points since Feb 4, 2022
What each source reports
CVE List
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 7, allows remote attackers to affect integrity via unknown vectors related to HotSpot. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from the original researcher that this vulnerability allows remote attackers to bypass permission checks by the MethodHandles method and modify arbitrary public final fields using reflection and type confusion, as demonstrated using integer and double fields to disable the security manager.
- Record
CVE-2013-2423- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
EUVDEUVD-2013-2369
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 7, allows remote attackers to affect integrity via unknown vectors related to HotSpot. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from the original researcher that this vulnerability allows remote attackers to bypass permission checks by the MethodHandles method and modify arbitrary public final fields using reflection and type confusion, as demonstrated using integer and double fields to disable the security manager.
- Record
EUVD-2013-2369- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-wq4h-35pf-mp23
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7...
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 7, allows remote attackers to affect integrity via unknown vectors related to HotSpot. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from the original researcher that this vulnerability allows remote attackers to bypass permission checks by the MethodHandles method and modify arbitrary public final fields using reflection and type confusion, as demonstrated using integer and double fields to disable the security manager.
- Record
GHSA-wq4h-35pf-mp23- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
CISA KEV No score
Oracle JRE Unspecified Vulnerability
Unspecified vulnerability in hotspot for Java Runtime Environment (JRE) allows remote attackers to affect integrity.
- Record
CVE-2013-2423- Updated
- 2026-11-02
NVD
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 7, allows remote attackers to affect integrity via unknown vectors related to HotSpot. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from the original researcher that this vulnerability allows remote attackers to bypass permission checks by the MethodHandles method and modify arbitrary public final fields using reflection and type confusion, as demonstrated using integer and double fields to disable the security manager.
- Record
CVE-2013-2423- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10534-1 No score
java-1_7_0-openjdk-1.7.0.121-1.1 on GA media
These are all security issues fixed in the java-1_7_0-openjdk-1.7.0.121-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10534-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
java-1.7.0-openjdkRed Hat:enterprise_linux:6::client From an advisory covering 22 CVEs |
before 1:1.7.0.19-2.3.9.1.el6_4 | 1:1.7.0.19-2.3.9.1.el6_4 |
java-1.7.0-openjdk-debuginfoRed Hat:enterprise_linux:6::client From an advisory covering 22 CVEs |
before 1:1.7.0.19-2.3.9.1.el6_4 | 1:1.7.0.19-2.3.9.1.el6_4 |
java-1.7.0-openjdk-demoRed Hat:enterprise_linux:6::client From an advisory covering 22 CVEs |
before 1:1.7.0.19-2.3.9.1.el6_4 | 1:1.7.0.19-2.3.9.1.el6_4 |
java-1.7.0-openjdk-develRed Hat:enterprise_linux:6::client From an advisory covering 22 CVEs |
before 1:1.7.0.19-2.3.9.1.el6_4 | 1:1.7.0.19-2.3.9.1.el6_4 |
java-1.7.0-openjdk-javadocRed Hat:enterprise_linux:6::client From an advisory covering 22 CVEs |
before 1:1.7.0.19-2.3.9.1.el6_4 | 1:1.7.0.19-2.3.9.1.el6_4 |
java-1.7.0-openjdk-srcRed Hat:enterprise_linux:6::client From an advisory covering 22 CVEs |
before 1:1.7.0.19-2.3.9.1.el6_4 | 1:1.7.0.19-2.3.9.1.el6_4 |
java-1.7.0-openjdkRed Hat:enterprise_linux:6::computenode From an advisory covering 22 CVEs |
before 1:1.7.0.19-2.3.9.1.el6_4 | 1:1.7.0.19-2.3.9.1.el6_4 |
java-1.7.0-openjdk-debuginfoRed Hat:enterprise_linux:6::computenode From an advisory covering 22 CVEs |
before 1:1.7.0.19-2.3.9.1.el6_4 | 1:1.7.0.19-2.3.9.1.el6_4 |
java-1.7.0-openjdk-demoRed Hat:enterprise_linux:6::computenode From an advisory covering 22 CVEs |
before 1:1.7.0.19-2.3.9.1.el6_4 | 1:1.7.0.19-2.3.9.1.el6_4 |
java-1.7.0-openjdk-develRed Hat:enterprise_linux:6::computenode From an advisory covering 22 CVEs |
before 1:1.7.0.19-2.3.9.1.el6_4 | 1:1.7.0.19-2.3.9.1.el6_4 |
Show 45 moreShow less
| Package | Affected | Fixed |
|---|---|---|
java-1.7.0-openjdk-javadocRed Hat:enterprise_linux:6::computenode From an advisory covering 22 CVEs |
before 1:1.7.0.19-2.3.9.1.el6_4 | 1:1.7.0.19-2.3.9.1.el6_4 |
java-1.7.0-openjdk-srcRed Hat:enterprise_linux:6::computenode From an advisory covering 22 CVEs |
before 1:1.7.0.19-2.3.9.1.el6_4 | 1:1.7.0.19-2.3.9.1.el6_4 |
java-1.7.0-openjdkRed Hat:enterprise_linux:6::server From an advisory covering 22 CVEs |
before 1:1.7.0.19-2.3.9.1.el6_4 | 1:1.7.0.19-2.3.9.1.el6_4 |
java-1.7.0-openjdk-debuginfoRed Hat:enterprise_linux:6::server From an advisory covering 22 CVEs |
before 1:1.7.0.19-2.3.9.1.el6_4 | 1:1.7.0.19-2.3.9.1.el6_4 |
java-1.7.0-openjdk-develRed Hat:enterprise_linux:6::server From an advisory covering 22 CVEs |
before 1:1.7.0.19-2.3.9.1.el6_4 | 1:1.7.0.19-2.3.9.1.el6_4 |
java-1.7.0-openjdk-demoRed Hat:enterprise_linux:6::server From an advisory covering 22 CVEs |
before 1:1.7.0.19-2.3.9.1.el6_4 | 1:1.7.0.19-2.3.9.1.el6_4 |
java-1.7.0-openjdk-javadocRed Hat:enterprise_linux:6::server From an advisory covering 22 CVEs |
before 1:1.7.0.19-2.3.9.1.el6_4 | 1:1.7.0.19-2.3.9.1.el6_4 |
java-1.7.0-openjdk-srcRed Hat:enterprise_linux:6::server From an advisory covering 22 CVEs |
before 1:1.7.0.19-2.3.9.1.el6_4 | 1:1.7.0.19-2.3.9.1.el6_4 |
java-1.7.0-openjdkRed Hat:enterprise_linux:6::workstation From an advisory covering 22 CVEs |
before 1:1.7.0.19-2.3.9.1.el6_4 | 1:1.7.0.19-2.3.9.1.el6_4 |
java-1.7.0-openjdk-debuginfoRed Hat:enterprise_linux:6::workstation From an advisory covering 22 CVEs |
before 1:1.7.0.19-2.3.9.1.el6_4 | 1:1.7.0.19-2.3.9.1.el6_4 |
java-1.7.0-openjdk-develRed Hat:enterprise_linux:6::workstation From an advisory covering 22 CVEs |
before 1:1.7.0.19-2.3.9.1.el6_4 | 1:1.7.0.19-2.3.9.1.el6_4 |
java-1.7.0-openjdk-demoRed Hat:enterprise_linux:6::workstation From an advisory covering 22 CVEs |
before 1:1.7.0.19-2.3.9.1.el6_4 | 1:1.7.0.19-2.3.9.1.el6_4 |
java-1.7.0-openjdk-javadocRed Hat:enterprise_linux:6::workstation From an advisory covering 22 CVEs |
before 1:1.7.0.19-2.3.9.1.el6_4 | 1:1.7.0.19-2.3.9.1.el6_4 |
java-1.7.0-openjdk-srcRed Hat:enterprise_linux:6::workstation From an advisory covering 22 CVEs |
before 1:1.7.0.19-2.3.9.1.el6_4 | 1:1.7.0.19-2.3.9.1.el6_4 |
java-1.7.0-openjdkRed Hat:enterprise_linux:5::server From an advisory covering 22 CVEs |
before 1:1.7.0.19-2.3.9.1.el5_9 | 1:1.7.0.19-2.3.9.1.el5_9 |
java-1.7.0-openjdk-debuginfoRed Hat:enterprise_linux:5::server From an advisory covering 22 CVEs |
before 1:1.7.0.19-2.3.9.1.el5_9 | 1:1.7.0.19-2.3.9.1.el5_9 |
java-1.7.0-openjdk-demoRed Hat:enterprise_linux:5::server From an advisory covering 22 CVEs |
before 1:1.7.0.19-2.3.9.1.el5_9 | 1:1.7.0.19-2.3.9.1.el5_9 |
java-1.7.0-openjdk-develRed Hat:enterprise_linux:5::server From an advisory covering 22 CVEs |
before 1:1.7.0.19-2.3.9.1.el5_9 | 1:1.7.0.19-2.3.9.1.el5_9 |
java-1.7.0-openjdk-javadocRed Hat:enterprise_linux:5::server From an advisory covering 22 CVEs |
before 1:1.7.0.19-2.3.9.1.el5_9 | 1:1.7.0.19-2.3.9.1.el5_9 |
java-1.7.0-openjdk-srcRed Hat:enterprise_linux:5::server From an advisory covering 22 CVEs |
before 1:1.7.0.19-2.3.9.1.el5_9 | 1:1.7.0.19-2.3.9.1.el5_9 |
java-1.7.0-oracleRed Hat:rhel_extras:5::server From an advisory covering 42 CVEs |
before 1:1.7.0.21-1jpp.1.el5 | 1:1.7.0.21-1jpp.1.el5 |
java-1.7.0-oracle-develRed Hat:rhel_extras:5::server From an advisory covering 42 CVEs |
before 1:1.7.0.21-1jpp.1.el5 | 1:1.7.0.21-1jpp.1.el5 |
java-1.7.0-oracle-javafxRed Hat:rhel_extras:5::server From an advisory covering 42 CVEs |
before 1:1.7.0.21-1jpp.1.el5 | 1:1.7.0.21-1jpp.1.el5 |
java-1.7.0-oracle-jdbcRed Hat:rhel_extras:5::server From an advisory covering 42 CVEs |
before 1:1.7.0.21-1jpp.1.el5 | 1:1.7.0.21-1jpp.1.el5 |
java-1.7.0-oracle-pluginRed Hat:rhel_extras:5::server From an advisory covering 42 CVEs |
before 1:1.7.0.21-1jpp.1.el5 | 1:1.7.0.21-1jpp.1.el5 |
java-1.7.0-oracle-srcRed Hat:rhel_extras:5::server From an advisory covering 42 CVEs |
before 1:1.7.0.21-1jpp.1.el5 | 1:1.7.0.21-1jpp.1.el5 |
java-1.7.0-oracleRed Hat:rhel_extras:6 From an advisory covering 42 CVEs |
before 1:1.7.0.21-1jpp.1.el6 | 1:1.7.0.21-1jpp.1.el6 |
java-1.7.0-oracle-develRed Hat:rhel_extras:6 From an advisory covering 42 CVEs |
before 1:1.7.0.21-1jpp.1.el6 | 1:1.7.0.21-1jpp.1.el6 |
java-1.7.0-oracle-javafxRed Hat:rhel_extras:6 From an advisory covering 42 CVEs |
before 1:1.7.0.21-1jpp.1.el6 | 1:1.7.0.21-1jpp.1.el6 |
java-1.7.0-oracle-jdbcRed Hat:rhel_extras:6 From an advisory covering 42 CVEs |
before 1:1.7.0.21-1jpp.1.el6 | 1:1.7.0.21-1jpp.1.el6 |
java-1.7.0-oracle-pluginRed Hat:rhel_extras:6 From an advisory covering 42 CVEs |
before 1:1.7.0.21-1jpp.1.el6 | 1:1.7.0.21-1jpp.1.el6 |
java-1.7.0-oracle-srcRed Hat:rhel_extras:6 From an advisory covering 42 CVEs |
before 1:1.7.0.21-1jpp.1.el6 | 1:1.7.0.21-1jpp.1.el6 |
java-1.7.0-ibmRed Hat:rhel_extras:5::server From an advisory covering 32 CVEs |
before 1:1.7.0.4.2-1jpp.1.el5_9 | 1:1.7.0.4.2-1jpp.1.el5_9 |
java-1.7.0-ibm-demoRed Hat:rhel_extras:5::server From an advisory covering 32 CVEs |
before 1:1.7.0.4.2-1jpp.1.el5_9 | 1:1.7.0.4.2-1jpp.1.el5_9 |
java-1.7.0-ibm-develRed Hat:rhel_extras:5::server From an advisory covering 32 CVEs |
before 1:1.7.0.4.2-1jpp.1.el5_9 | 1:1.7.0.4.2-1jpp.1.el5_9 |
java-1.7.0-ibm-jdbcRed Hat:rhel_extras:5::server From an advisory covering 32 CVEs |
before 1:1.7.0.4.2-1jpp.1.el5_9 | 1:1.7.0.4.2-1jpp.1.el5_9 |
java-1.7.0-ibm-pluginRed Hat:rhel_extras:5::server From an advisory covering 32 CVEs |
before 1:1.7.0.4.2-1jpp.1.el5_9 | 1:1.7.0.4.2-1jpp.1.el5_9 |
java-1.7.0-ibm-srcRed Hat:rhel_extras:5::server From an advisory covering 32 CVEs |
before 1:1.7.0.4.2-1jpp.1.el5_9 | 1:1.7.0.4.2-1jpp.1.el5_9 |
java-1.7.0-ibmRed Hat:rhel_extras:6 From an advisory covering 32 CVEs |
before 1:1.7.0.4.2-1jpp.1.el6_4 | 1:1.7.0.4.2-1jpp.1.el6_4 |
java-1.7.0-ibm-demoRed Hat:rhel_extras:6 From an advisory covering 32 CVEs |
before 1:1.7.0.4.2-1jpp.1.el6_4 | 1:1.7.0.4.2-1jpp.1.el6_4 |
java-1.7.0-ibm-develRed Hat:rhel_extras:6 From an advisory covering 32 CVEs |
before 1:1.7.0.4.2-1jpp.1.el6_4 | 1:1.7.0.4.2-1jpp.1.el6_4 |
java-1.7.0-ibm-jdbcRed Hat:rhel_extras:6 From an advisory covering 32 CVEs |
before 1:1.7.0.4.2-1jpp.1.el6_4 | 1:1.7.0.4.2-1jpp.1.el6_4 |
java-1.7.0-ibm-pluginRed Hat:rhel_extras:6 From an advisory covering 32 CVEs |
before 1:1.7.0.4.2-1jpp.1.el6_4 | 1:1.7.0.4.2-1jpp.1.el6_4 |
java-1.7.0-ibm-srcRed Hat:rhel_extras:6 From an advisory covering 32 CVEs |
before 1:1.7.0.4.2-1jpp.1.el6_4 | 1:1.7.0.4.2-1jpp.1.el6_4 |
java-1_7_0-openjdkopenSUSE:Tumbleweed From an advisory covering 304 CVEs |
before 1.7.0.121-1.1 | 1.7.0.121-1.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Metasploit | Java Applet Reflection Type Confusion Remote Code Execution | 2013-01-10 |
| Exploit-DB | Java Applet - Reflection Type Confusion Remote Code Execution (Metasploit) | 2013-04-23 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| exploitation, exploits | ||
| first indexed | CVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, Metasploit, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-2423 is a medium vulnerability (CVSS 4.3) in Oracle Java Runtime Environment (jre), published April 17, 2013. CISA lists it as known to be exploited, since May 25, 2022. EUVD reports exploitation since May 25, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 85.2%, the 99th percentile. No source names a fixed version.
References
security.gentoo.org/glsa/glsa-201406-32.xml
weblog.ikvm.net/PermaLink.aspx?guid=acd2dd6d-1028-4996-95df-efa42ac237f0
us-cert.gov/ncas/alerts/TA13-107A
wiki.mageia.org/en/Support/Advisories/MGASA-2013-0130
rhn.redhat.com/errata/RHSA-2013-0757.html
hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/b453d9be6b3f
Show 194 moreShow less
exploit-db.com/exploits/24976
mandriva.com/security/advisories?name=MDVSA-2013:161
lists.opensuse.org/opensuse-updates/2013-06/msg00099.html
ubuntu.com/usn/USN-1806-1
blog.spiderlabs.com/2013/04/java-is-so-confusing.html
bugzilla.redhat.com/show_bug.cgi?id=952398
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16700
oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html
blog.fuseyism.com/index.php/2013/04/22/security-icedtea-2-3-9-for-openjdk-7-released
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-2423
nvd.nist.gov/vuln/detail/CVE-2013-2423
github.com/advisories/GHSA-wq4h-35pf-mp23
access.redhat.com/errata/RHSA-2013:0751
icedtea.classpath.org/hg/release/icedtea7-2.3/file/icedtea-2.3.9/NEWS
security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0751.json
cve.org/CVERecord?id=CVE-2013-0401
ibm.com/developerworks/java/jdk/alerts
isg.rhul.ac.uk/tls
openssl.org/news/secadv_20130205.txt
polarssl.org/tech-updates/releases/polarssl-1.2.5-released
suse.com/security/cve/CVE-2011-3563
This page doesn't list everything
Left out here: 303 references. The JSON record has them.