‹ Back to list

CVE-2010-1423

Status: ModifiedHigh (9.3)—Exploit
Severity9.3High · CVSS 2.0
Exploitation probability56 %higher than 99% of CVEs
Active exploitationNonot in the CISA catalog
Public exploitAvailablePublished on Exploit-DB · Metasploit module (reliable, widely available exploit)

Argument injection vulnerability in the URI handler in (a) Java NPAPI plugin and (b) Java Deployment Toolkit in Java 6 Update 10, 19, and other versions, when running on Windows and possibly on Linux, allows remote attackers to execute arbitrary code via the (1) -J or (2) -XXaltjvm argument to javaws.exe, which is processed by the launch method. NOTE: some of these details are obtained from third party information.

CVSS

Base score
9.3
Version
2.0
Vector
AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days
56 %
Percentile among all scored CVEs
99
Score date
10/21/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Public exploits

Exploit code or detection templates are publicly available. This is not the same as confirmed active exploitation (KEV), but it raises the risk: patch with priority.

Affected technologies (2)

Oracle — JDKOracle — JRE

CWEs

References

Show 18 references

Raw JSON (NVD)

Show
{
  "id": "CVE-2010-1423",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 9.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2010-04-15T21:30:00.290",
  "references": [
    {
      "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2010-April/074036.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://osvdb.org/63648",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/39260",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.kb.cert.org/vuls/id/886582",
      "tags": [
        "US Government Resource"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.reversemode.com/index.php?option=com_content&task=view&id=67&Itemid=1",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securitytracker.com/id?1023840",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2010/0853",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/57615",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14090",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2010-April/074036.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://osvdb.org/63648",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/39260",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.kb.cert.org/vuls/id/886582",
      "tags": [
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.reversemode.com/index.php?option=com_content&task=view&id=67&Itemid=1",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id?1023840",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2010/0853",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/57615",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14090",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Argument injection vulnerability in the URI handler in (a) Java NPAPI plugin and (b) Java Deployment Toolkit in Java 6 Update 10, 19, and other versions, when running on Windows and possibly on Linux, allows remote attackers to execute arbitrary code via the (1) -J or (2) -XXaltjvm argument to javaws.exe, which is processed by the launch method.  NOTE: some of these details are obtained from third party information."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de inyección de argumento en el manejador URI en (a) Java NPAPI plugin y (b) Java Deployment Toolkit en Java v6 Update v10, 1v9, y otras versiones, cuando corre en Windows y probablemente en Linux, permite a atacantes remotos ejecutar código de su elección a través del argumento (1) -J o (2) -XXaltjvm en  javaws.exe, que es procesado por el método launch. NOTA: algunos de estos detalles han sido obtenidos a partir de terceros."
    }
  ],
  "lastModified": "2026-06-16T23:18:21.830",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oracle:jdk:*:update19:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A77914E1-4F75-42AD-8220-1C53C2E74EC9",
              "versionEndIncluding": "1.6.0"
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:1.6.0:update10:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DC92B7EC-849F-4255-9D55-43681B8DADC4"
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:*:update19:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "35349FBC-04E5-4824-93B5-F210B902DDAC",
              "versionEndIncluding": "1.6.0"
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:1.6.0:update_10:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8160B01D-FEF3-43E6-8B37-36CF3360B6AF"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}