CVE-2013-0424: XSS
An XSS flaw was discovered in the sun.rmi.transport.proxy CGIHandler class. When error was detected in the request query parameters, an untrusted user input was used in an error string without further sanitization.
External Reference:
http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html
Other sources
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.240 and earlier, and OpenJDK 7, allows remote attackers to affect integrity via vectors related to RMI. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to cross-site scripting (XSS) in the sun.rmi.transport.proxy CGIHandler class that does not properly handle error messages in a (1) command or (2) port number.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-0424?
CVE-2013-0424 is classified as a moderate severity cross-site scripting (XSS) vulnerability.
How do I fix CVE-2013-0424?
To fix CVE-2013-0424, update your Oracle JRE or JDK to the latest version provided by Oracle.
Which products are affected by CVE-2013-0424?
CVE-2013-0424 affects multiple versions of Oracle's JRE and JDK, including versions 1.5.0 to 1.7.0, as well as specific versions of IcedTea.
What type of vulnerability is CVE-2013-0424?
CVE-2013-0424 is a cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts into web pages.
Can CVE-2013-0424 be exploited remotely?
Yes, CVE-2013-0424 can be exploited remotely if the affected application is accessible via the internet.