CVE-2013-0431

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, and OpenJDK 7, allows…

Low3.7Known exploitedEPSS 90.1%

Published: 31 Jan 2013
Updated: 1 Oct 2026
Reserved: 7 Dec 2012
Assigned by: oracle

Description

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, and OpenJDK 7, allows user-assisted remote attackers to bypass the Java security sandbox via unspecified vectors related to JMX, aka "Issue 52," a different vulnerability than CVE-2013-1490.

Exploited in the wild

CISA lists this vulnerability in its Known Exploited Vulnerabilities catalog as Oracle JRE Sandbox Bypass Vulnerability.

Added: 25 May 2022
Fix due (US federal): 15 Jun 2022
Used by ransomware: Known

Apply updates per vendor instructions.

Scores

CVSS scores of CVE-2013-0431, by who scored it
Scored by	CVSS	Score	Vector
CISA-ADPADP (enrichment)	3.1	Low3.7	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
NVDNVD · Analyzed	3.1	Low3.7	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS (exploitation in 30 days): 90.1% · top 0.2% of all CVEs (5 Nov 2026)
CISA SSVC: Exploitation: active · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Low 3.7.

Weakness

Affected products

n/a
- affected n/a

References (20)

oval:org.mitre.oval:def:19418 (opens in a new tab)vdb-entrysignaturex_refsource_OVALx_transferred
GLSA-201406-32 (opens in a new tab)vendor-advisoryx_refsource_GENTOOx_transferred
MDVSA-2013:095 (opens in a new tab)vendor-advisoryx_refsource_MANDRIVAx_transferred
http://www.informationweek.com/security/application-security/java-hacker-uncovers-two-flaws-in-latest/240146717 (opens in a new tab)x_refsource_MISCx_transferred
TA13-032A (opens in a new tab)third-party-advisoryx_refsource_CERTx_transferred
20130118 [SE-2012-01] Java 7 Update 11 confirmed to be vulnerable (opens in a new tab)mailing-listx_refsource_FULLDISCx_transferred
VU#858729 (opens in a new tab)third-party-advisoryx_refsource_CERT-VNx_transferred
RHSA-2013:0237 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
HPSBUX02857 (opens in a new tab)vendor-advisoryx_refsource_HPx_transferred
RHSA-2013:0247 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
http://arstechnica.com/security/2013/01/critical-java-vulnerabilies-confirmed-in-latest-version/ (opens in a new tab)x_refsource_MISCx_transferred
20130122 Re: [SE-2012-01] Java 7 Update 11 confirmed to be vulnerable (opens in a new tab)mailing-listx_refsource_FULLDISCx_transferred
HPSBMU02874 (opens in a new tab)vendor-advisoryx_refsource_HPx_transferred
http://blogs.computerworld.com/malware-and-vulnerabilities/21693/yet-another-java-security-flaw-discovered-number-53 (opens in a new tab)x_refsource_MISCx_transferred
openSUSE-SU-2013:0377 (opens in a new tab)vendor-advisoryx_refsource_SUSEx_transferred
20130122 Re: [SE-2012-01] Java 7 Update 11 confirmed to be vulnerable (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
oval:org.mitre.oval:def:16579 (opens in a new tab)vdb-entrysignaturex_refsource_OVALx_transferred
http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html (opens in a new tab)x_refsource_CONFIRMx_transferred
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0056 (opens in a new tab)x_refsource_CONFIRMx_transferred
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-0431 (opens in a new tab)government-resource

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2013-0431](https://trackcve.app/badge/CVE-2013-0431.svg)](https://trackcve.app/cve/CVE-2013-0431)

Record last updated 1 Oct 2026, 20:28 UTC.