CVE-2018-2879

high-risk
Published 2018-04-19

Vulnerability in the Oracle Access Manager component of Oracle Fusion Middleware (subcomponent: Authentication Engine). Supported versions that are affected are 11.1.2.3.0 and 12.2.1.3.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. While the vulnerability is in Oracle Access Manager, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. Note: Please refer to Doc ID <a href="http://support.oracle.com/CSP/main/article?cmd=show&type=NOT&id=2386496.1">My Oracle Support Note 2386496.1 for instructions on how to address this issue. CVSS 3.0 Base Score 9.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H).

Do I need to act?

!
44.5% chance of exploitation in next 30 days
EPSS score — higher than 56% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.0/10 Critical
NETWORK / HIGH complexity

Affected Products (2)

Affected Vendors

Oracle

References (16)

Third Party Advisory http://packetstormsecurity.com/files/152551/OAMbuster-Multi-Threaded-CVE-2018-28...
Mailing List http://seclists.org/fulldisclosure/2019/Apr/28
Patch http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
Third Party Advisory http://www.securityfocus.com/bid/103788
Third Party Advisory http://www.securitytracker.com/id/1040695
Product https://github.com/MostafaSoliman/Oracle-OAM-Padding-Oracle-CVE-2018-2879-Exploi...
Mailing List https://seclists.org/bugtraq/2019/Apr/27
Exploit https://www.sec-consult.com/en/blog/2018/05/oracle-access-managers-identity-cris...
Third Party Advisory http://packetstormsecurity.com/files/152551/OAMbuster-Multi-Threaded-CVE-2018-28...
Mailing List http://seclists.org/fulldisclosure/2019/Apr/28
Patch http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
Third Party Advisory http://www.securityfocus.com/bid/103788
Third Party Advisory http://www.securitytracker.com/id/1040695
Product https://github.com/MostafaSoliman/Oracle-OAM-Padding-Oracle-CVE-2018-2879-Exploi...
Mailing List https://seclists.org/bugtraq/2019/Apr/27
Exploit https://www.sec-consult.com/en/blog/2018/05/oracle-access-managers-identity-cris...
50
/ 100
high-risk
Severity 26/34 · High
Exploitability 17/34 · Moderate
Exposure 7/34 · Low