Vulnerability Details : CVE-2013-0444
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Beans. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "insufficient checks for cached results" by the Java Beans MethodFinder, which might allow attackers to access methods that should only be accessible to privileged code.
Threat overview for CVE-2013-0444
Top countries where our scanners detected CVE-2013-0444
Top open port discovered on systems with this issue
80
IPs affected by CVE-2013-0444 47
Threat actors abusing to this issue?
Yes
Find out if you* are
affected by CVE-2013-0444!
*Directly or indirectly through your vendors, service providers and 3rd parties.
Powered by
attack surface intelligence
from SecurityScorecard.
Exploit prediction scoring system (EPSS) score for CVE-2013-0444
Probability of exploitation activity in the next 30 days: 1.92%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 87 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2013-0444
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
7.6
|
HIGH | AV:N/AC:H/Au:N/C:C/I:C/A:C |
4.9
|
10.0
|
NIST |
References for CVE-2013-0444
-
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16614
Repository / Oval Repository
-
http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html
Java CPU Feb 2013Vendor Advisory
-
http://marc.info/?l=bugtraq&m=136439120408139&w=2
'[security bulletin] HPSBUX02857 SSRT101103 rev.1 - HP-UX Running Java, Remote Unauthorized Access, D' - MARC
-
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0056
Support/Advisories/MGASA-2013-0056 - Mageia wiki
-
http://rhn.redhat.com/errata/RHSA-2013-0247.html
RHSA-2013:0247 - Security Advisory - Red Hat Customer Portal
-
http://www.kb.cert.org/vuls/id/858729
VU#858729 - Oracle Java contains multiple vulnerabilitiesUS Government Resource
-
http://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/jdk/rev/ce04db4aba39
release/icedtea7-forest-2.3/jdk: ce04db4aba39
-
http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00001.html
[security-announce] openSUSE-SU-2013:0377-1: critical: java-1_7_0-openjd
-
http://www.mandriva.com/security/advisories?name=MDVSA-2013:095
mandriva.com
-
http://marc.info/?l=bugtraq&m=136733161405818&w=2
'[security bulletin] HPSBMU02874 SSRT101184 rev.1 - HP Service Manager, Java Runtime Environment (JRE' - MARC
-
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19349
Repository / Oval Repository
-
http://www.us-cert.gov/cas/techalerts/TA13-032A.html
Oracle Java Multiple Vulnerabilities | CISAUS Government Resource
-
http://rhn.redhat.com/errata/RHSA-2013-0237.html
RHSA-2013:0237 - Security Advisory - Red Hat Customer Portal
-
http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=907218
907218 – (CVE-2013-0444) CVE-2013-0444 OpenJDK: MethodFinder insufficient checks for cached results (Beans, 7200493)
-
http://security.gentoo.org/glsa/glsa-201406-32.xml
IcedTea JDK: Multiple vulnerabilities (GLSA 201406-32) — Gentoo security
Products affected by CVE-2013-0444
- cpe:2.3:a:oracle:jdk:1.7.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:jdk:1.7.0:update1:*:*:*:*:*:*
- cpe:2.3:a:oracle:jdk:1.7.0:update2:*:*:*:*:*:*
- cpe:2.3:a:oracle:jdk:1.7.0:update5:*:*:*:*:*:*
- cpe:2.3:a:oracle:jdk:1.7.0:update6:*:*:*:*:*:*
- cpe:2.3:a:oracle:jdk:1.7.0:update3:*:*:*:*:*:*
- cpe:2.3:a:oracle:jdk:1.7.0:update4:*:*:*:*:*:*
- cpe:2.3:a:oracle:jdk:1.7.0:update10:*:*:*:*:*:*
- cpe:2.3:a:oracle:jdk:1.7.0:update11:*:*:*:*:*:*
- cpe:2.3:a:oracle:jdk:1.7.0:update7:*:*:*:*:*:*
- cpe:2.3:a:oracle:jdk:1.7.0:update9:*:*:*:*:*:*
- cpe:2.3:a:oracle:jre:1.7.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:jre:1.7.0:update1:*:*:*:*:*:*
- cpe:2.3:a:oracle:jre:1.7.0:update4:*:*:*:*:*:*
- cpe:2.3:a:oracle:jre:1.7.0:update5:*:*:*:*:*:*
- cpe:2.3:a:oracle:jre:1.7.0:update2:*:*:*:*:*:*
- cpe:2.3:a:oracle:jre:1.7.0:update3:*:*:*:*:*:*
- cpe:2.3:a:oracle:jre:1.7.0:update6:*:*:*:*:*:*
- cpe:2.3:a:oracle:jre:1.7.0:update7:*:*:*:*:*:*
- cpe:2.3:a:oracle:jre:1.7.0:update9:*:*:*:*:*:*
- cpe:2.3:a:oracle:jre:1.7.0:update10:*:*:*:*:*:*
- cpe:2.3:a:oracle:jre:1.7.0:update11:*:*:*:*:*:*