FKIE_CVE-2013-1490

Vulnerability from fkie_nvd - Published: 2013-01-31 14:55 - Updated: 2026-06-16 23:51
Severity
Summary
Unspecified vulnerability in Oracle Java SE 7 Update 11 (JRE 1.7.0_11-b21) allows user-assisted remote attackers to bypass the Java security sandbox via unspecified vectors, aka "Issue 51," a different vulnerability than CVE-2013-0431. NOTE: as of 20130130, this vulnerability does not contain any independently-verifiable details, and there is no vendor acknowledgement. A CVE identifier is being assigned because this vulnerability has received significant public attention, and the original researcher has an established history of releasing vulnerability reports that have been fixed by vendors. NOTE: this issue also exists in SE 6, but it cannot be exploited without a separate vulnerability.
References
secalert_us@oracle.comhttp://arstechnica.com/security/2013/01/critical-java-vulnerabilies-confirmed-in-latest-version/
secalert_us@oracle.comhttp://blogs.computerworld.com/malware-and-vulnerabilities/21693/yet-another-java-security-flaw-discovered-number-53
secalert_us@oracle.comhttp://seclists.org/fulldisclosure/2013/Jan/142
secalert_us@oracle.comhttp://seclists.org/fulldisclosure/2013/Jan/195
secalert_us@oracle.comhttp://www.informationweek.com/security/application-security/java-hacker-uncovers-two-flaws-in-latest/240146717
secalert_us@oracle.comhttp://www.securityfocus.com/archive/1/525387/30/0/threaded
af854a3a-2127-422b-91ae-364da2661108http://arstechnica.com/security/2013/01/critical-java-vulnerabilies-confirmed-in-latest-version/
af854a3a-2127-422b-91ae-364da2661108http://blogs.computerworld.com/malware-and-vulnerabilities/21693/yet-another-java-security-flaw-discovered-number-53
af854a3a-2127-422b-91ae-364da2661108http://seclists.org/fulldisclosure/2013/Jan/142
af854a3a-2127-422b-91ae-364da2661108http://seclists.org/fulldisclosure/2013/Jan/195
af854a3a-2127-422b-91ae-364da2661108http://www.informationweek.com/security/application-security/java-hacker-uncovers-two-flaws-in-latest/240146717
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/archive/1/525387/30/0/threaded
Impacted products
Vendor Product Version
oracle jdk 1.7.0
oracle jre 1.7.0
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "secalert_us@oracle.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oracle:jdk:1.7.0:update11:*:*:*:*:*:*",
              "matchCriteriaId": "30B480BC-0886-4B19-B0A5-57B531077F40",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:1.7.0:update11:*:*:*:*:*:*",
              "matchCriteriaId": "B2B20041-EB5D-4FA4-AC7D-C35E7878BCFD",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Unspecified vulnerability in Oracle Java SE 7 Update 11 (JRE 1.7.0_11-b21) allows user-assisted remote attackers to bypass the Java security sandbox via unspecified vectors, aka \"Issue 51,\" a different vulnerability than CVE-2013-0431.  NOTE: as of 20130130, this vulnerability does not contain any independently-verifiable details, and there is no vendor acknowledgement. A CVE identifier is being assigned because this vulnerability has received significant public attention, and the original researcher has an established history of releasing vulnerability reports that have been fixed by vendors.  NOTE: this issue also exists in SE 6, but it cannot be exploited without a separate vulnerability."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad no especificada en Oracle Java SE 7 Update 11 (JRE 1.7.0_11-b21) permite a atacantes remotos asistidos por el usuario evitar el recinto de seguridad de Java (Sandbox) a trav\u00e9s de vectores no especificados, tambi\u00e9n conocido como \"Problema 51\", una vulnerabilidad diferente a CVE-2013-0431. NOTA: a partir de 20130130, esta vulnerabilidad no contiene ning\u00fan detalle independientemente verificables, y no hay un reconocimiento de proveedores. Un identificador CVE se asigna a esta vulnerabilidad por que ha recibido una considerable atenci\u00f3n del p\u00fablico, y el investigador original tiene un historial establecido de emisi\u00f3n de informes de vulnerabilidades que han sido corregidos por los proveedores. NOTA: este problema tambi\u00e9n existe en la SE 6, pero no puede ser explotada sin una vulnerabilidad independiente."
    }
  ],
  "id": "CVE-2013-1490",
  "lastModified": "2026-06-16T23:51:31.753",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ]
  },
  "published": "2013-01-31T14:55:01.967",
  "references": [
    {
      "source": "secalert_us@oracle.com",
      "url": "http://arstechnica.com/security/2013/01/critical-java-vulnerabilies-confirmed-in-latest-version/"
    },
    {
      "source": "secalert_us@oracle.com",
      "url": "http://blogs.computerworld.com/malware-and-vulnerabilities/21693/yet-another-java-security-flaw-discovered-number-53"
    },
    {
      "source": "secalert_us@oracle.com",
      "url": "http://seclists.org/fulldisclosure/2013/Jan/142"
    },
    {
      "source": "secalert_us@oracle.com",
      "url": "http://seclists.org/fulldisclosure/2013/Jan/195"
    },
    {
      "source": "secalert_us@oracle.com",
      "url": "http://www.informationweek.com/security/application-security/java-hacker-uncovers-two-flaws-in-latest/240146717"
    },
    {
      "source": "secalert_us@oracle.com",
      "url": "http://www.securityfocus.com/archive/1/525387/30/0/threaded"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://arstechnica.com/security/2013/01/critical-java-vulnerabilies-confirmed-in-latest-version/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://blogs.computerworld.com/malware-and-vulnerabilities/21693/yet-another-java-security-flaw-discovered-number-53"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://seclists.org/fulldisclosure/2013/Jan/142"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://seclists.org/fulldisclosure/2013/Jan/195"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.informationweek.com/security/application-security/java-hacker-uncovers-two-flaws-in-latest/240146717"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/525387/30/0/threaded"
    }
  ],
  "sourceIdentifier": "secalert_us@oracle.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.