Log in Start free

Actively exploited · Published Oct 19, 2011 · Assigned by oracle

CVE-2011-3544

Critical 9.8 Exploited

In plain English

A critical-severity improper access control in Java SE JDK and JRE from Oracle. Attackers are actively exploiting it in the wild (listed by CISA on March 3, 2022). The chance it is exploited in the next 30 days is estimated at 96.7% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit. Apply updates per vendor instructions.

Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)96.7%top 0.1% of all CVEs
Exploited in the wildYesCISA KEV since Mar 3, 2022
Attack tooling1Metasploit

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Mar 24, 2022.

Official description

Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7 and 6 Update 27 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability via unknown vectors related to Scripting.

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References