CISA Known Exploited Vulnerability

CVE-2011-3544

Oracle · Java SE JDK and JRE

Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability

Date added 2022-03-03

BOD 22-01 due date 2022-03-24

CWE —

Ransomware Unknown

CISA description

An access control vulnerability exists in the Applet Rhino Script Engine component of Oracle's Java Runtime Environment allows an attacker to remotely execute arbitrary code.

Required action

Apply updates per vendor instructions.

Notes & references

https://nvd.nist.gov/vuln/detail/CVE-2011-3544

Where this lands in 800-53

Vulnerability data triggers these controls during assessment and continuous monitoring.

RA-5 · Vulnerability Monitoring and Scanning
SI-2 · Flaw Remediation
CM-6 · Configuration Settings
SI-7 · Software, Firmware, and Information Integrity
CM-8 · System Component Inventory

External lookups

NVD · CVE-2011-3544
CVE.org · CVE-2011-3544
CISA KEV catalog (canonical)