How severe is CVE-2001-1008?

CVE-2001-1008 has a CVSS 2.0 base score of 7.5, rated high severity.

Is CVE-2001-1008 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (75th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2001-1008?

CVE-2001-1008 primarily affects Sun Java Plug-in. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2001-1008?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2001-1008 published?

CVE-2001-1008 was published on 2001-08-31 and last updated on 2026-06-16.

CVE-2001-1008

CVE-2001-1008 is a high-severity vulnerability in Sun Java Plug-in with a CVSS 2.0 base score of 7.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: High (CVSS 2.0 base score 7.5)
EPSS exploit prediction: 2% (75th percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Sun Java Plug-in
Published: 2001-08-31
Last modified: 2026-06-16

Description

Java Plugin 1.4 for JRE 1.3 executes signed applets even if the certificate is expired, which could allow remote attackers to conduct unauthorized activities via an applet that has been signed by an expired certificate.

Frequently asked questions

What is CVE-2001-1008?: Java Plugin 1.4 for JRE 1.3 executes signed applets even if the certificate is expired, which could allow remote attackers to conduct unauthorized activities via an applet that has been signed by an expired certificate.
How severe is CVE-2001-1008?: CVE-2001-1008 has a CVSS 2.0 base score of 7.5, rated high severity.
Is CVE-2001-1008 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (75th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2001-1008?: CVE-2001-1008 primarily affects Sun Java Plug-in. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2001-1008?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2001-1008 published?: CVE-2001-1008 was published on 2001-08-31 and last updated on 2026-06-16.

References

Affected products (2)

cpe:2.3:a:sun:java_plug-in:1.4:*:*:*:*:*:*:*
cpe:2.3:a:sun:jre:1.3.0:*:*:*:*:*:*:*

More vulnerabilities in Sun Java Plug-in

CVE-2003-1516 — Medium (CVSS 6.8): The org.apache.xalan.processor.XSLProcessorVersion class in Java Plug-in 1.4.2_01 allows signed and unsigned applets to…
CVE-2003-1521 — Medium (CVSS 6.4): Sun Java Plug-In 1.4 through 1.4.2_02 allows remote attackers to repeatedly access the floppy drive via the…
CVE-2005-4845 — Medium (CVSS 5.0): The Java Plug-in 1.4.2_03 and 1.4.2_04 controls, and the 1.4.2_03 and 1.4.2_04 <applet> redirector controls, allow…

All CVEs affecting Sun Java Plug-in →