‹ Volver al listado

CVE-2013-1491

Estado: ModificadaAlta (10)—PoC
Gravedad10Alta · CVSS 2.0
Probabilidad de explotación16 %mayor que el 97 % de las CVE
Explotación activaNono figura en el catálogo de CISA
Exploit públicoDisponiblePrueba de concepto en GitHub (no verificada)

El componente Java Runtime Environment (JRE) en Java SE versión 7 Update 17 y anteriores, versión 6 Update 43 y anteriores, versión 5.0 Update 41 y anteriores, y JavaFX versión 2.2.7 y anteriores de Oracle, permite a los atacantes remotos ejecutar código arbitrario por medio de vectores relacionados con 2D, como fue demostrado por Joshua Drake durante una competencia pwn2Own en CanSecWest 2013.

CVSS

Puntuación base
10
Versión
2.0
Vector
AV:N/AC:L/Au:N/C:C/I:C/A:C

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días
16 %
Percentil entre todas las CVEs puntuadas
97
Fecha de la puntuación
21/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Exploits públicos

Hay código de explotación o plantillas de detección públicos. No es lo mismo que explotación activa confirmada (KEV), pero aumenta el riesgo: parchee con prioridad.

⚠️ Las pruebas de concepto de GitHub no están verificadas: algunas son falsas o contienen malware. No las ejecute nunca fuera de un laboratorio aislado.

Tecnologías afectadas (2)

Oracle — JDKOracle — JRE

CWE

Referencias

Mostrar las 36 referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2013-1491",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 10,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "secalert_us@oracle.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2013-03-08T18:55:01.607",
  "references": [
    {
      "url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03898880",
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Pwn2Own-2013/ba-p/5981157",
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "http://lists.apple.com/archives/security-announce/2013/Apr/msg00001.html",
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00013.html",
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00001.html",
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00007.html",
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "http://marc.info/?l=bugtraq&m=137283787217316&w=2",
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2013-0757.html",
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2013-0758.html",
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2013-1455.html",
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2013-1456.html",
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html",
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "http://www.us-cert.gov/ncas/alerts/TA13-107A",
      "tags": [
        "US Government Resource"
      ],
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "http://www.zdnet.com/pwn2own-down-go-all-the-browsers-7000012283/",
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16663",
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19482",
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19553",
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "https://twitter.com/thezdi/status/309438311112507392",
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03898880",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Pwn2Own-2013/ba-p/5981157",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.apple.com/archives/security-announce/2013/Apr/msg00001.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00013.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00001.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00007.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://marc.info/?l=bugtraq&m=137283787217316&w=2",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2013-0757.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2013-0758.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2013-1455.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2013-1456.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.us-cert.gov/ncas/alerts/TA13-107A",
      "tags": [
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.zdnet.com/pwn2own-down-go-all-the-browsers-7000012283/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16663",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19482",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19553",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://twitter.com/thezdi/status/309438311112507392",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, 5.0 Update 41 and earlier, and JavaFX 2.2.7 and earlier allows remote attackers to execute arbitrary code via vectors related to 2D, as demonstrated by Joshua Drake during a Pwn2Own competition at CanSecWest 2013."
    },
    {
      "lang": "es",
      "value": "El componente Java Runtime Environment (JRE) en Java SE versión 7 Update 17 y anteriores, versión 6 Update 43 y anteriores, versión 5.0 Update 41 y anteriores, y JavaFX versión 2.2.7 y anteriores de Oracle, permite a los atacantes remotos ejecutar código arbitrario por medio de vectores relacionados con 2D, como fue demostrado por Joshua Drake durante una competencia pwn2Own en CanSecWest 2013."
    }
  ],
  "lastModified": "2026-06-16T23:51:31.873",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oracle:jdk:1.7.0:update17:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "130849CD-A581-4FE6-B2AA-99134F16FE65"
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:1.7.0:update17:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "37B5B98B-0E41-4397-8AB0-C18C6F10AED1"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secalert_us@oracle.com"
}