ByteOS Network

NVD Vulnerability Details :

CVE-2018-2879

Analyzed

Source-secalert_us@oracle.com

Published At-19 Apr, 2018 | 02:29

Updated At-03 Oct, 2019 | 00:03

Vulnerability in the Oracle Access Manager component of Oracle Fusion Middleware (subcomponent: Authentication Engine). Supported versions that are affected are 11.1.2.3.0 and 12.2.1.3.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. While the vulnerability is in Oracle Access Manager, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. Note: Please refer to Doc ID <a href="http://support.oracle.com/CSP/main/article?cmd=show&type=NOT&id=2386496.1">My Oracle Support Note 2386496.1 for instructions on how to address this issue. CVSS 3.0 Base Score 9.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H).

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.0	9.0	CRITICAL	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Primary	2.0	6.8	MEDIUM	AV:N/AC:M/Au:N/C:P/I:P/A:P

CPE Matches

Oracle Corporation

>>access_manager>>11.1.2.3.0

cpe:2.3:a:oracle:access_manager:11.1.2.3.0:*:*:*:*:*:*:*

Oracle Corporation

>>access_manager>>12.2.1.3.0

cpe:2.3:a:oracle:access_manager:12.2.1.3.0:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
NVD-CWE-noinfo	Primary	nvd@nist.gov

References

Hyperlink	Source	Resource
http://packetstormsecurity.com/files/152551/OAMbuster-Multi-Threaded-CVE-2018-2879-Scanner.html	secalert_us@oracle.com	Third Party Advisory VDB Entry
http://seclists.org/fulldisclosure/2019/Apr/28	secalert_us@oracle.com	Mailing List Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html	secalert_us@oracle.com	Patch Vendor Advisory
http://www.securityfocus.com/bid/103788	secalert_us@oracle.com	Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1040695	secalert_us@oracle.com	VDB Entry Third Party Advisory
https://github.com/MostafaSoliman/Oracle-OAM-Padding-Oracle-CVE-2018-2879-Exploit	secalert_us@oracle.com	Product Third Party Advisory
https://seclists.org/bugtraq/2019/Apr/27	secalert_us@oracle.com	Mailing List Third Party Advisory
https://www.sec-consult.com/en/blog/2018/05/oracle-access-managers-identity-crisis/	secalert_us@oracle.com	Exploit Third Party Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History