CVE-2013-0422

Confirmed PUBLISHED

Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using the public...

Oracle · Java

Exploited in the wild Used in malware PoC available

Recommended Action

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.

View KEV Feed Talk to Sales

Confidence

Confirmed

Exploitation Status

Exploited in the wild

Observed in Sensors

Attempts (30d)

—

Unique Attacker IPs

—

CISA KEV

In CISA KEV

CVSS / EPSS

9.8 Critical

At a Glance

Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using the public getMBeanInstantiator method in the JmxMBeanServer class to obtain a reference to a private MBeanInstantiator object, then retrieving arbitrary Class references using the findClass method, and (2) using the Reflection API with recursion in a way that bypasses a security check by the java.lang.invoke.MethodHandles.Lookup.checkSecurityManager method due to the inability of the sun.reflect.Reflection.getCallerClass method to skip frames related to the new reflection API, as exploited in the wild in January 2013, as demonstrated by Blackhole and Nuclear Pack, and a different vulnerability than CVE-2012-4681 and CVE-2012-3174. NOTE: some parties have mapped the recursive Reflection API issue to CVE-2012-3174, but CVE-2012-3174 is for a different vulnerability whose details are not public as of 20130114. CVE-2013-0422 covers both the JMX/MBean and Reflection API issues. NOTE: it was originally reported that Java 6 was also vulnerable, but the reporter has retracted this claim, stating that Java 6 is not exploitable because the relevant code is called in a way that does not bypass security checks. NOTE: as of 20130114, a reliable third party has claimed that the findClass/MBeanInstantiator vector was not fixed in Oracle Java 7 Update 11. If there is still a vulnerable condition, then a separate CVE identifier might be created for the unfixed issue.

cisa java metasploit malware

CVE Published: Jan 10, 2013
Exploitation Reported: May 25, 2022
CVSS: 9.8 Critical
EPSS: —

Remote Low complexity No user interaction Unauthenticated

Affected Versions

Vendor	Product	Version	Status
n/a	n/a	n/a	Affected

CVE References

RHSA-2013:0156 rhn.redhat.com · Vendor Advisory http://rhn.redhat.com/errata/RHSA-2013-0156.html
MDVSA-2013:095 mandriva.com · Vendor Advisory http://www.mandriva.com/security/advisories?name=MDVSA-2013:095
openSUSE-SU-2013:0199 lists.opensuse.org · Vendor Advisory http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00025...
RHSA-2013:0165 rhn.redhat.com · Vendor Advisory http://rhn.redhat.com/errata/RHSA-2013-0165.html
USN-1693-1 ubuntu.com · Vendor Advisory http://www.ubuntu.com/usn/USN-1693-1

Show 14 more references

VU#625617 kb.cert.org · Third-Party Advisory http://www.kb.cert.org/vuls/id/625617
TA13-010A us-cert.gov · Third-Party Advisory http://www.us-cert.gov/cas/techalerts/TA13-010A.html
20130110 [SE-2012-01] 'Fix' for Issue 32 exploited by new Java 0-day code seclists.org · Mailing List http://seclists.org/bugtraq/2013/Jan/48
malware.dontneedcoffee.com/2013/01/0-day-17u10-spotted-in-while-disable... malware.dontneedcoffee.com · CVE Record http://malware.dontneedcoffee.com/2013/01/0-day-17u10-spotted-in-whil...
blog.fuseyism.com/index.php/2013/01/15/security-icedtea-2-1-4-... blog.fuseyism.com · CVE Record http://blog.fuseyism.com/index.php/2013/01/15/security-icedtea-2-1-4-...
partners.immunityinc.com/idocs/Java%20MBeanInstantiator.findClass%200... partners.immunityinc.com · CVE Record https://partners.immunityinc.com/idocs/Java%20MBeanInstantiator.findC...
blog.fireeye.com/research/2013/01/happy-new-year-from-new-jav... blog.fireeye.com · CVE Record http://blog.fireeye.com/research/2013/01/happy-new-year-from-new-java...
www-304.ibm.com/connections/blogs/PSIRT/entry/oracle_java_7_... www-304.ibm.com · CVE Record https://www-304.ibm.com/connections/blogs/PSIRT/entry/oracle_java_7_s...
wiki.mageia.org/en/Support/Advisories/MGASA-2013-0018 wiki.mageia.org · CVE Record https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0018
immunityproducts.blogspot.ca/2013/01/confirmed-java-only-fixed-one-of-two... immunityproducts.blogspot.ca · CVE Record http://immunityproducts.blogspot.ca/2013/01/confirmed-java-only-fixed...
threatpost.com/en_us/blogs/nasty-new-java-zero-day-found-ex... threatpost.com · CVE Record https://threatpost.com/en_us/blogs/nasty-new-java-zero-day-found-expl...
oracle.com/technetwork/topics/security/alert-cve-2013-0... oracle.com · CVE Record http://www.oracle.com/technetwork/topics/security/alert-cve-2013-0422...
krebsonsecurity.com/2013/01/zero-day-java-exploit-debuts-in-crim... krebsonsecurity.com · CVE Record http://krebsonsecurity.com/2013/01/zero-day-java-exploit-debuts-in-cr...
labs.alienvault.com/labs/index.php/2013/new-year-new-java-zeroday labs.alienvault.com · CVE Record http://labs.alienvault.com/labs/index.php/2013/new-year-new-java-zero...

Recommended Actions

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.
Check enrichment artifacts for scanner coverage and available PoCs before rolling remediation validation.
Use the Pro API to automate enrichment, telemetry, and workflow delivery for VM, SOC, and CTI pipelines.

Known Exploited Vulnerability Sources

Catalogues that list this CVE as a known exploited vulnerability.

Per-source evidence links for KEV attestations are available through the KEVIntel Pro API.

Learn about Pro API access

Source	Added
CISA First	2022-05-25 00:00 UTC

Scanner Artifacts

Nuclei and Metasploit references linked to this CVE.

Scanner	Reference	Detected
Metasploit	https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/java_jre17_jmxbean.rb	Apr 28, 2025

CVSS Scores

CVSS v3.1 9.8 Critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 10.0 High

AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitation Status

Exploited in the wild

Recorded 2022-05-25 00:00:00 UTC · CISA

Used in malware

Recorded 2026-06-02 14:08:25 UTC · CISA

Proof of concept available

Recorded 2025-04-28 15:02:16 UTC

Weaknesses (CWE)

CWE-284

Improper Access Control

Scanner Integrations

Scanner	Reference	Detected
Metasploit	https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/java_jre17_jmxbean.rb	Apr 28, 2025

Potential Proof of Concepts

These PoCs are unverified and could contain malware. Use at your own risk.

java_jre17_jmxbean

metasploit · Created Unknown

Metasploit module for CVE-2013-0422

Automate This Intelligence with the Pro API

Confidence scoring, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

View Pro Pricing View API Docs

Pro API Example

GET /api/v2/pro/kevs/CVE-2013-0422

{
  "cve_id": "CVE-2013-0422",
  "title": "Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attac...",
  "affected_vendor": "Oracle",
  "affected_product": "Java",
  "affected_versions": [
    { "vendor": "...", "product": "...", "status": "affected", "display_label": "..." }
  ],
  "confidence": "Confirmed",
  "cvss_score": 9.8,
  "epss_score": null,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": false
  },
  "sensor_telemetry": { "...": "Pro API fields" },
  "proof_of_concepts": [ "..." ],
  "scanner_integrations": [ "..." ]
}

The free JSON API returns basic KEV fields only. Confidence, telemetry, and artifact enrichment require Pro API access.

CVE-2013-0422

At a Glance

Affected Versions

CVE References

Recommended Actions

Known Exploited Vulnerability Sources

Scanner Artifacts

Virtual Patch

CVSS Scores

Exploitation Status

Weaknesses (CWE)

Scanner Integrations

Potential Proof of Concepts

Timeline

Automate This Intelligence with the Pro API