Log in Start free

Actively exploited · Published Apr 1, 2010 · Assigned by oracle

CVE-2010-0840

Critical 9.8 Exploited

In plain English

A critical-severity security flaw in Java Runtime Environment (JRE) from Oracle. Attackers are actively exploiting it in the wild (listed by CISA on May 25, 2022). The chance it is exploited in the next 30 days is estimated at 96.3% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit. Apply updates per vendor instructions.

Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)96.3%top 0.1% of all CVEs
Exploited in the wildYesCISA KEV since May 25, 2022
Attack tooling1Metasploit

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Jun 15, 2022.

Official description

Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, and 1.4.2_25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the March 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is related to improper checks when executing privileged methods in the Java Runtime Environment (JRE), which allows attackers to execute arbitrary code via (1) an untrusted object that extends the trusted class but has not modified a certain method, or (2) "a similar trust issue with interfaces," aka "Trusted Methods Chaining Remote Code Execution Vulnerability."

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

References