{"id":"CVE-2013-2460","published":"2013-06-18T22:00:00Z","modified":"2024-08-06T15:36:46Z","title":"Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier…","vendor":null,"product":null,"tier":"core","eol":null,"description":{"text":"Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Serviceability.  NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to \"insufficient access checks\" in the tracing component.","provenance":"source","from":"CVE.org"},"summary":{"text":"The flaw is an unspecified vulnerability in the Java Runtime Environment (JRE) component of Oracle Java SE 7 Update 21 and earlier, and of OpenJDK 7, related to the Serviceability component. An attacker who can reach the affected JRE remotely, through unknown vectors, may be able to affect confidentiality, integrity, and availability, and a separate unconfirmed claim from another vendor describes a sandbox bypass via insufficient access checks in the tracing component, which Oracle has not addressed.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:11:59Z"},"cvss":null,"epss":{"score":0.7004,"percentile":0.99374,"date":"2026-10-28","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2021-08-17","exploitedFirstSeen":"2021-08-17","ransomware":false,"evidence":[{"url":"https://dl.acm.org/doi/pdf/10.1145/3465481.3465758","date":"2021-08-17"}],"evidenceTotal":1,"provenance":"source"},"exploited":true,"otx":{"pulseCount":3,"pulses":[{"name":"VirusTotal report\n                    for Bang Bang#2.xls","url":"https://otx.alienvault.com/pulse/69b4e2ca96bf79781b0ae3bd","created":"2026-03-14"},{"name":"Thor Lite Scanner - Cigabuntu (Parrot Version) vs. The Book of Shadows","url":"https://otx.alienvault.com/pulse/666ac558d08da6cfb3ba135b","created":"2024-06-13"},{"name":"Thor-Lite Linux 64 (06.11.24) - enriched a bit more but not 'pruned'","url":"https://otx.alienvault.com/pulse/6668b85065eec626e4766a38","created":"2024-06-11"}],"provenance":"machine"},"cwes":[],"references":[{"url":"http://rhn.redhat.com/errata/RHSA-2013-1060.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://security.gentoo.org/glsa/glsa-201406-32.xml","tags":["vendor-advisory","x_refsource_GENTOO"]},{"url":"http://hg.openjdk.java.net/jdk7u/jdk7u/jdk/rev/160cde99bb1a","tags":["x_refsource_MISC"]},{"url":"http://www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.html","tags":["x_refsource_CONFIRM"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00028.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://marc.info/?l=bugtraq&m=137545505800971&w=2","tags":["vendor-advisory","x_refsource_HP"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00027.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://secunia.com/advisories/54154","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19129","tags":["vdb-entry","signature","x_refsource_OVAL"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17116","tags":["vdb-entry","signature","x_refsource_OVAL"]},{"url":"http://www.us-cert.gov/ncas/alerts/TA13-169A","tags":["third-party-advisory","x_refsource_CERT"]},{"url":"http://advisories.mageia.org/MGASA-2013-0185.html","tags":["x_refsource_CONFIRM"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=975122","tags":["x_refsource_CONFIRM"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0963.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2013:183","tags":["vendor-advisory","x_refsource_MANDRIVA"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21642336","tags":["x_refsource_CONFIRM"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Remote attackers exploit JRE component via unknown vectors","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"Unspecified vulnerability in the Java Runtime Environment (JRE) component","start":0,"end":73}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1211","name":"Exploitation for Stealth","tactics":["stealth"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Sandbox bypass evades Java security restrictions","mappingType":"primary_impact","evidence":[{"from":"description","quote":"allows remote attackers to bypass the Java sandbox","start":388,"end":438}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[{"id":"SRC-93c55e10ab45afc37c85","title":"Microsoft Security","publisher":"download.microsoft.com","url":"https://download.microsoft.com/download/E/B/0/EB0F50CC-989C-4B66-B7F6-68CD3DC90DE3/Microsoft_Security_Intelligence_Report_Volume_21_English.pdf","date":null,"mentions":[{"quote":"CVE-2015-0313, among others), and Java (CVE-2013-2460), although exploit","start":99222,"end":99294},{"quote":"CVE-2013-2460, 56","start":261483,"end":261500}]},{"id":"SRC-619721166ae9d9d7fdcd","title":"Microsoft Security","publisher":"download.microsoft.com","url":"https://download.microsoft.com/download/4/4/C/44CDEF0E-7924-4787-A56A-16261691ACE3/Microsoft_Security_Intelligence_Report_Volume_19_English.pdf","date":null,"mentions":[{"quote":"among others), and Java (CVE-2013-2460), although exploit kit","start":80052,"end":80113},{"quote":"31, 32, 40\r\nCVE-2009-0075, 54\r\nCVE-2010-0188, 52\r\nCVE-2010-0840, 47, 49\r\nCVE-2010-2568, 40, 43, 50\r\nCVE-2010-3336, 52\r\nCVE-2011-1823, 50, 51\r\nCVE-2011-3874, 50, 51\r\nCVE-2012-0158, 52\r\nCVE-2012-0507, 47, 49\r\nCVE-2012-1723, 47, 48, 49\r\nCVE-2012-1889, 54\r\nCVE-2013-0074, 46\r\nCVE-2013-0422, 47, 49\r\nCVE-2013-2460,","start":237915,"end":238224}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2013-2406","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2013-2406","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[{"id":26529,"url":"https://www.exploit-db.com/exploits/26529","title":"Java Applet - ProviderSkeleton Insecure Invoke Method (Metasploit)","type":"remote","platform":"multiple","date":"2013-07-01","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2013-07-01"},"metasploit":[{"name":"Java Applet ProviderSkeleton Insecure Invoke Method","module":"exploit/multi/browser/java_jre17_provider_skeleton","type":"exploit","disclosureDate":"2013-06-18","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/java_jre17_provider_skeleton.rb"}],"first":{"date":"2013-06-18","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/java_jre17_provider_skeleton.rb"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1211"],"provenance":"ai"}],"timeline":[{"date":"2013-06-18","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2013-2460","provenance":"source"},{"date":"2013-06-18","kind":"exploit-public","label":"First public exploit: Metasploit; later: Exploit-DB 2013-07-01","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/java_jre17_provider_skeleton.rb","provenance":"source"},{"date":"2021-08-17","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://dl.acm.org/doi/pdf/10.1145/3465481.3465758","provenance":"source"}],"speed":{"daysToPublicExploit":0,"firstExploitFrom":"Metasploit","daysToKev":null},"priority":{"score":67.4,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1899 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.87,"detail":"percentile 0.9937"},{"name":"Named in threat reports","points":6.13,"detail":"2 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 Exploit-DB entry; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":1.37,"detail":"3 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}