CVE-2013-1489 Security feature bypass in n/a

Critical 10.0 Published 31 Jan 2013 Updated 6 Aug 2024

Remote attackers can bypass Java security settings to execute unsigned code without user prompts, requiring a Java update.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2013-1489?

CVE-2013-1489 is a critical vulnerability in Oracle Jdk, published on 31 Jan 2013. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 10 and Update 11, when running on Windows using Internet Explorer, Firefox, Opera, and Google Chrome, allows remote attackers to bypass the "Very High" security level of the Java Control Panel and execute unsigned Java code without prompting the user via unknown vectors, aka "Issue 53" and the "Java Security Slider" vulnerability.

Which versions are affected by CVE-2013-1489?

It affects 2 products.

Products include Oracle Jdk, Oracle Jre.

How do I fix CVE-2013-1489?

Upgrade to a fixed version.

Is CVE-2013-1489 being exploited?

There is no known exploitation of CVE-2013-1489 in the wild and no public exploit code.

All Oracle Jdk vulnerabilities

Sources

Also known as GHSA-2684-x557-ppqj.