Vulnerability record · CVE-2013-0431 · published 31 January 2013
CVE-2013-0431: Oracle JRE and OpenJDK JMX sandbox bypass
Oracle · Jre
An unspecified flaw in the Java Runtime Environment (JRE) component of Oracle Java SE 7 through Update 11 and OpenJDK 7 allows a user-assisted remote attacker to bypass the Java security sandbox via vectors related to JMX. Because the sandbox is the main boundary protecting the host from untrusted Java code, a bypass lets hostile applets or applications escape their restricted environment.
Description
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, and OpenJDK 7, allows user-assisted remote attackers to bypass the Java security sandbox via unspecified vectors related to JMX, aka "Issue 52," a different vulnerability than CVE-2013-1490.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Automated analysis
high priorityThe flaw is a sandbox bypass with confirmed exploitation in CISA KEV and very high EPSS, though the CVSS base score is only 5.3 and the record lacks technical detail.
What it is
An unspecified flaw in the Java Runtime Environment (JRE) component of Oracle Java SE 7 through Update 11 and OpenJDK 7 allows a user-assisted remote attacker to bypass the Java security sandbox via vectors related to JMX. Because the sandbox is the main boundary protecting the host from untrusted Java code, a bypass lets hostile applets or applications escape their restricted environment.
Impact
An attacker who gets a victim to run malicious Java content can escape the sandbox and execute code outside the intended restrictions, potentially compromising the host. The record does not specify the exact post-exploitation capability beyond the sandbox bypass.
Attack surface
Reached remotely over the network, but the description states the attack is user-assisted, meaning the victim must load or run the malicious Java content. No authentication is required; the CVSS vector lists UI:N, which conflicts with the user-assisted wording in the description.
Exploitation
CVE-2013-0431 is listed in CISA KEV (added 2022-05-25) with known ransomware campaign use, and EPSS shows a 30-day probability of 0.89987 (99.787th percentile), indicating observed exploitation and high predicted activity.
What to do
- Apply the Oracle Java SE CPU February 2013 update (or later) and the corresponding OpenJDK and Linux distribution errata referenced in the advisories.
- Remove or disable the Java browser plug-in and Java Web Start where they are not required, and block untrusted Java content.
- Restrict execution of untrusted applets and JNLP applications through application control or browser policy.
- If Java cannot be removed, keep JRE versions current and enforce a short patch cycle for Java endpoints.
- Monitor vendor advisories for the affected Java SE 7 and OpenJDK 7 releases and verify installed versions against them.
Detection
- Hunt for Java processes spawning unexpected child processes or making outbound network connections, which can indicate a sandbox escape.
- Monitor for execution of applets or JNLP files from untrusted or newly observed sources.
- Inventory endpoints for Java SE 7 through Update 11 and OpenJDK 7 installations and flag unpatched versions.
- Review proxy and DNS logs for Java-related downloads or callbacks associated with known exploit activity.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2013-0431 to the Known Exploited Vulnerabilities catalog on 25 May 2022 as "Oracle JRE Sandbox Bypass Vulnerability". CISA reports known use in ransomware campaigns. Required action: Apply updates per vendor instructions. Federal deadline 15 June 2022.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2013-0431 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2013-0431), CISA KEV, FIRST EPSS (scores of 2026-09-24). This page is refreshed as NVD updates the record.
