CVE-2013-1488

Exp

The Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 6 and 7, allows remote attackers to execute arbitrary code via unspecified vectors involving reflection, Libraries, "improper toString calls," and the JDBC driver manager, as demonstrated by James Forshaw during a Pwn2Own competition at CanSecWest 2013.

Published: 2013-03-08 Last update: 2026-06-16 Assigner: [email protected] Source: [email protected]

Conclusion & alert: CVE-2013-1488 is rated High Exploit Risk (90.6/100): CVSS Critical severity, with high exploitation likelihood (EPSS 86.96%, 100th percentile). Core evidence: 1 public exploit reference(s) are indexed (Exploit-DB). Mandatory action: Public exploits are available—assess exposure, apply mitigations, and prioritize patching.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Public exploit references (Exploit-DB) for CVE-2013-1488

EDB-ID Source Kind Published Link
26135 exploit_db edb 2013-06-11 Exploit-DB ↗

Exploit prediction scoring system (EPSS) score for CVE-2013-1488

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2026-06-15 86.25% 86.96% +0.71%
2 2026-04-20 91.59% 86.25% -5.34%
3 2026-01-30 91.59%

Full EPSS history (33 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2013-1488

CVSS metrics for this CVE.

Base score Version Severity Vector Exploitability Impact Score source
10.0 2.0 HIGH
AV:N/AC:L/Au:N/C:C/I:C/A:C Click to expand
Access vector (AV:N)
Can be exploited remotely over network reachability.
Access complexity (AC:L)
Exploitation conditions are straightforward and predictable.
Authentication (AU:N)
No authentication is required.
Confidentiality impact (C:C)
Complete confidentiality impact.
Integrity impact (I:C)
Complete integrity impact.
Availability impact (A:C)
Complete availability impact.
10.0 10.0 [email protected]

Weakness enumeration for CVE-2013-1488

OS Trackers for CVE-2013-1488

vendor priority summary link
gentoo high CVE-2013-1488: 2 GLSA(s) (201401-30, 201406-32), 6 atom(s) (app-emulation/emul-linux-x86-java, dev-java/icedtea-bin, dev-java/oracle-jdk-bin, dev-java/oracle-jre-bin, dev-java/sun-jdk, dev-java/sun-jre-bin); latest impact high. https://bugs.gentoo.org/buglist.cgi?quicksearch=CVE-2013-1488
redhat critical https://access.redhat.com/security/cve/CVE-2013-1488
ubuntu medium CVE-2013-1488 medium priority: Ubuntu including 3 source packages (openjdk-6, openjdk-6b18, openjdk-7), 21 status rows across 7 suites (hardy, lucid, oneiric, precise, quantal, raring, upstream): released 9, DNE 6, deferred 3, ignored 3. https://ubuntu.com/security/CVE-2013-1488

Affected software / configurations for CVE-2013-1488

Vendor Product Version Raw CPE
oracle jdk 1.7.0 cpe:2.3:a:oracle:jdk:1.7.0:update17:*:*:*:*:*:*
oracle jre 1.7.0 cpe:2.3:a:oracle:jre:1.7.0:update17:*:*:*:*:*:*

References for CVE-2013-1488

URL Tags
http://blog.fuseyism.com/index.php/2013/04/22/security-icedtea-2-3-9-for-openjdk-7-released/
http://blog.fuseyism.com/index.php/2013/04/25/security-icedtea-1-11-11-1-12-5-for-openjdk-6-released/
http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Pwn2Own-2013/ba-p/5981157
http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/a19614a3dabb
http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00007.html
http://lists.opensuse.org/opensuse-updates/2013-05/msg00017.html
http://lists.opensuse.org/opensuse-updates/2013-06/msg00099.html
http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2013-April/022796.html
http://rhn.redhat.com/errata/RHSA-2013-0752.html
http://rhn.redhat.com/errata/RHSA-2013-0757.html
http://security.gentoo.org/glsa/glsa-201406-32.xml
http://www.mandriva.com/security/advisories?name=MDVSA-2013:145
http://www.mandriva.com/security/advisories?name=MDVSA-2013:161
http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html
http://www.ubuntu.com/usn/USN-1806-1
http://www.us-cert.gov/ncas/alerts/TA13-107A US Government Resource
http://www.zdnet.com/pwn2own-down-go-all-the-browsers-7000012283/
https://bugzilla.redhat.com/show_bug.cgi?id=920247
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16511
https://twitter.com/thezdi/status/309425888188043264
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0124
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0130
cvelogic Threat Intelligence