CVE-2013-0431: Oracle JRE Sandbox Bypass Vulnerability

Published Jan 31, 2013

Updated

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, and OpenJDK 7, allows user-assisted remote attackers to bypass the Java security sandbox via unspecified vectors related to JMX, aka "Issue 52," a different vulnerability than CVE-2013-1490.

Other sources

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle allows remote attackers to bypass the Java security sandbox.

— CISA

Affected Software

25 affected components

Oracle Java Runtime Environment (JRE)

Oracle JRE=1.7.0

Oracle JRE=1.7.0-update1

Oracle JRE=1.7.0-update10

Oracle JRE=1.7.0-update11

Oracle JRE=1.7.0-update2

Oracle JRE=1.7.0-update3

Oracle JRE=1.7.0-update4

Oracle JRE=1.7.0-update5

Oracle JRE=1.7.0-update6

Oracle JRE=1.7.0-update7

Oracle JRE=1.7.0-update9

Oracle OpenJDK=7

Oracle JRE=1.7.0

Oracle JDK=1.7.0

Oracle JDK=1.7.0-update1

Oracle JDK=1.7.0-update10

Oracle JDK=1.7.0-update11

Oracle JDK=1.7.0-update2

Oracle JDK=1.7.0-update3

Oracle JDK=1.7.0-update4

Oracle JDK=1.7.0-update5

Oracle JDK=1.7.0-update6

Oracle JDK=1.7.0-update7

Oracle JDK=1.7.0-update9

Event History

Jan 31, 2013

CVE Published

via MITRE·02:10 PM

Data Sourced

via MITRE·02:10 PM

Description

Data Sourced

via NVD·02:55 PM

DescriptionSeverityWeaknessAffected Software

May 25, 2022

Known Exploited

via CISA·12:00 AM

Known Ransomware

via CISA·12:00 AM

Sep 15, 57083

Event

via NVD·04:46 PM

Frequently Asked Questions

What is the severity of CVE-2013-0431?

CVE-2013-0431 has been classified as a high severity vulnerability due to the potential for remote code execution.

How do I fix CVE-2013-0431?

To fix CVE-2013-0431, update the Oracle Java Runtime Environment (JRE) to the latest version that addresses this vulnerability.

What versions are affected by CVE-2013-0431?

CVE-2013-0431 affects Oracle Java SE 7 through Update 11 and OpenJDK 7.

Can CVE-2013-0431 be exploited without user interaction?

CVE-2013-0431 requires user-assisted actions, making it more challenging for attackers to exploit it.

Is there a workaround for CVE-2013-0431?

A temporary workaround for CVE-2013-0431 is to disable the Java plugin in browsers until the JRE is updated.