CVE-2012-4681
Summary
| CVE | CVE-2012-4681 |
|---|---|
| State | PUBLISHED |
| Assigner | mitre |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2012-08-28 00:55:01 UTC |
| Updated | 2026-04-21 18:38:11 UTC |
| Description | Multiple vulnerabilities in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier allow remote attackers to execute arbitrary code via a crafted applet that bypasses SecurityManager restrictions by (1) using com.sun.beans.finder.ClassFinder.findClass and leveraging an exception with the forName method to access restricted classes from arbitrary packages such as sun.awt.SunToolkit, then (2) using "reflection with a trusted immediate caller" to leverage the getField method to access and modify private fields, as exploited in the wild in August 2012 using Gondzz.class and Gondvv.class. |
Risk And Classification
Primary CVSS: v3.1 9.8 CRITICAL from [email protected]
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.941400000 probability, percentile 0.999160000 (date 2026-04-25)
CISA KEV: Listed on 2022-03-03; due 2022-03-24; ransomware use Known
Problem Types: NVD-CWE-Other | CWE-284 | n/a | CWE-284 CWE-284 Improper Access Control
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Primary | 9.8 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | ADP | DECLARED | 9.8 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | Secondary | 9.8 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 2.0 | [email protected] | Primary | 10 | AV:N/AC:L/Au:N/C:C/I:C/A:C |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
NoneUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
HighAvailability
HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
LowAuthentication
NoneConfidentiality
CompleteIntegrity
CompleteAvailability
CompleteAV:N/AC:L/Au:N/C:C/I:C/A:C
CISA Known Exploited Vulnerability
| Vendor | Oracle |
|---|---|
| Product | Java SE |
| Name | Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability |
| Required Action | Apply updates per vendor instructions. |
| Notes | https://nvd.nist.gov/vuln/detail/CVE-2012-4681 |
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Oracle | Jdk | 1.6.0 | - | All | All |
| Application | Oracle | Jdk | 1.6.0 | update1 | All | All |
| Application | Oracle | Jdk | 1.6.0 | update10 | All | All |
| Application | Oracle | Jdk | 1.6.0 | update11 | All | All |
| Application | Oracle | Jdk | 1.6.0 | update12 | All | All |
| Application | Oracle | Jdk | 1.6.0 | update13 | All | All |
| Application | Oracle | Jdk | 1.6.0 | update14 | All | All |
| Application | Oracle | Jdk | 1.6.0 | update15 | All | All |
| Application | Oracle | Jdk | 1.6.0 | update16 | All | All |
| Application | Oracle | Jdk | 1.6.0 | update17 | All | All |
| Application | Oracle | Jdk | 1.6.0 | update18 | All | All |
| Application | Oracle | Jdk | 1.6.0 | update19 | All | All |
| Application | Oracle | Jdk | 1.6.0 | update2 | All | All |
| Application | Oracle | Jdk | 1.6.0 | update20 | All | All |
| Application | Oracle | Jdk | 1.6.0 | update21 | All | All |
| Application | Oracle | Jdk | 1.6.0 | update22 | All | All |
| Application | Oracle | Jdk | 1.6.0 | update23 | All | All |
| Application | Oracle | Jdk | 1.6.0 | update24 | All | All |
| Application | Oracle | Jdk | 1.6.0 | update25 | All | All |
| Application | Oracle | Jdk | 1.6.0 | update26 | All | All |
| Application | Oracle | Jdk | 1.6.0 | update27 | All | All |
| Application | Oracle | Jdk | 1.6.0 | update29 | All | All |
| Application | Oracle | Jdk | 1.6.0 | update3 | All | All |
| Application | Oracle | Jdk | 1.6.0 | update30 | All | All |
| Application | Oracle | Jdk | 1.6.0 | update31 | All | All |
| Application | Oracle | Jdk | 1.6.0 | update32 | All | All |
| Application | Oracle | Jdk | 1.6.0 | update33 | All | All |
| Application | Oracle | Jdk | 1.6.0 | update34 | All | All |
| Application | Oracle | Jdk | 1.6.0 | update4 | All | All |
| Application | Oracle | Jdk | 1.6.0 | update5 | All | All |
| Application | Oracle | Jdk | 1.6.0 | update6 | All | All |
| Application | Oracle | Jdk | 1.6.0 | update7 | All | All |
| Application | Oracle | Jdk | 1.6.0 | update8 | All | All |
| Application | Oracle | Jdk | 1.6.0 | update9 | All | All |
| Application | Oracle | Jdk | 1.7.0 | - | All | All |
| Application | Oracle | Jdk | 1.7.0 | update1 | All | All |
| Application | Oracle | Jdk | 1.7.0 | update2 | All | All |
| Application | Oracle | Jdk | 1.7.0 | update3 | All | All |
| Application | Oracle | Jdk | 1.7.0 | update4 | All | All |
| Application | Oracle | Jdk | 1.7.0 | update5 | All | All |
| Application | Oracle | Jdk | 1.7.0 | update6 | All | All |
| Application | Oracle | Jre | 1.6.0 | - | All | All |
| Application | Oracle | Jre | 1.6.0 | update1 | All | All |
| Application | Oracle | Jre | 1.6.0 | update10 | All | All |
| Application | Oracle | Jre | 1.6.0 | update11 | All | All |
| Application | Oracle | Jre | 1.6.0 | update12 | All | All |
| Application | Oracle | Jre | 1.6.0 | update13 | All | All |
| Application | Oracle | Jre | 1.6.0 | update14 | All | All |
| Application | Oracle | Jre | 1.6.0 | update15 | All | All |
| Application | Oracle | Jre | 1.6.0 | update16 | All | All |
| Application | Oracle | Jre | 1.6.0 | update17 | All | All |
| Application | Oracle | Jre | 1.6.0 | update18 | All | All |
| Application | Oracle | Jre | 1.6.0 | update19 | All | All |
| Application | Oracle | Jre | 1.6.0 | update2 | All | All |
| Application | Oracle | Jre | 1.6.0 | update20 | All | All |
| Application | Oracle | Jre | 1.6.0 | update21 | All | All |
| Application | Oracle | Jre | 1.6.0 | update22 | All | All |
| Application | Oracle | Jre | 1.6.0 | update23 | All | All |
| Application | Oracle | Jre | 1.6.0 | update24 | All | All |
| Application | Oracle | Jre | 1.6.0 | update25 | All | All |
| Application | Oracle | Jre | 1.6.0 | update26 | All | All |
| Application | Oracle | Jre | 1.6.0 | update27 | All | All |
| Application | Oracle | Jre | 1.6.0 | update29 | All | All |
| Application | Oracle | Jre | 1.6.0 | update3 | All | All |
| Application | Oracle | Jre | 1.6.0 | update30 | All | All |
| Application | Oracle | Jre | 1.6.0 | update31 | All | All |
| Application | Oracle | Jre | 1.6.0 | update32 | All | All |
| Application | Oracle | Jre | 1.6.0 | update33 | All | All |
| Application | Oracle | Jre | 1.6.0 | update34 | All | All |
| Application | Oracle | Jre | 1.6.0 | update4 | All | All |
| Application | Oracle | Jre | 1.6.0 | update5 | All | All |
| Application | Oracle | Jre | 1.6.0 | update6 | All | All |
| Application | Oracle | Jre | 1.6.0 | update7 | All | All |
| Application | Oracle | Jre | 1.6.0 | update9 | All | All |
| Application | Oracle | Jre | 1.7.0 | - | All | All |
| Application | Oracle | Jre | 1.7.0 | update1 | All | All |
| Application | Oracle | Jre | 1.7.0 | update2 | All | All |
| Application | Oracle | Jre | 1.7.0 | update3 | All | All |
| Application | Oracle | Jre | 1.7.0 | update4 | All | All |
| Application | Oracle | Jre | 1.7.0 | update5 | All | All |
| Application | Oracle | Jre | 1.7.0 | update6 | All | All |
| Operating System | Redhat | Enterprise Linux Desktop | 6.0 | All | All | All |
| Operating System | Redhat | Enterprise Linux Eus | 6.3 | All | All | All |
| Operating System | Redhat | Enterprise Linux Server | 6.0 | All | All | All |
| Operating System | Redhat | Enterprise Linux Workstation | 6.0 | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| New Java 0day exploited in the wild - Alienvault Labs | af854a3a-2127-422b-91ae-364da2661108 | labs.alienvault.com | Broken Link, Exploit |
| '[security bulletin] HPSBUX02824 SSRT100970 rev.1 - HP-UX Running Java, Remote Execution of Arbitrary' - MARC | af854a3a-2127-422b-91ae-364da2661108 | marc.info | Issue Tracking, Mailing List, Third Party Advisory |
| Metasploit: Let's start the week with a new Jav... | SecurityStreet | af854a3a-2127-422b-91ae-364da2661108 | community.rapid7.com | Broken Link, Third Party Advisory |
| Red Hat Customer Portal | af854a3a-2127-422b-91ae-364da2661108 | rhn.redhat.com | Third Party Advisory |
| Alert for CVE-2012-4681 | af854a3a-2127-422b-91ae-364da2661108 | www.oracle.com | Vendor Advisory |
| Malware Intelligence Lab from FireEye - Research & Analysis of Zero-Day & Advanced Targeted Threats:Zero-Day Season is Not Over Yet | af854a3a-2127-422b-91ae-364da2661108 | blog.fireeye.com | Third Party Advisory |
| DeepEnd Research: CVE-2012-4681 Java 7 0-Day vulnerability analysis | af854a3a-2127-422b-91ae-364da2661108 | www.deependresearch.org | Broken Link, Third Party Advisory |
| About Secunia Research | Flexera | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Not Applicable |
| [security-announce] SUSE-SU-2012:1231-1: important: Security update for | af854a3a-2127-422b-91ae-364da2661108 | lists.opensuse.org | Mailing List |
| Immunity Products: Java 0day analysis (CVE-2012-4681) | af854a3a-2127-422b-91ae-364da2661108 | immunityproducts.blogspot.com | Exploit, Third Party Advisory |
| US-CERT Alert TA12-240A - Oracle Java 7 Security Manager Bypass Vulnerability | af854a3a-2127-422b-91ae-364da2661108 | www.us-cert.gov | Third Party Advisory, US Government Resource |
| Oracle Java Runtime Environment Remote Code Execution Vulnerability | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | Broken Link, Third Party Advisory, VDB Entry |
| www.cisa.gov/known-exploited-vulnerabilities-catalog | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | www.cisa.gov | US Government Resource |
| [security-announce] SUSE-SU-2012:1398-1: important: Security update for | af854a3a-2127-422b-91ae-364da2661108 | lists.opensuse.org | Mailing List |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
| CISA Known Exploited Vulnerabilities catalog | CISA | www.cisa.gov | kev |
No vendor comments have been submitted for this CVE.
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| ADP | 2022-03-03T00:00:00.000Z | CVE-2012-4681 added to CISA KEV |
There are currently no legacy QID mappings associated with this CVE.