Vulnerability Description
Vulnerability in the Oracle Access Manager component of Oracle Fusion Middleware (subcomponent: Authentication Engine). Supported versions that are affected are 11.1.2.3.0 and 12.2.1.3.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. While the vulnerability is in Oracle Access Manager, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. Note: Please refer to Doc ID <a href="http://support.oracle.com/CSP/main/article?cmd=show&type=NOT&id=2386496.1">My Oracle Support Note 2386496.1 for instructions on how to address this issue. CVSS 3.0 Base Score 9.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H).
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Oracle | Access Manager | 11.1.2.3.0 |
References
- http://packetstormsecurity.com/files/152551/OAMbuster-Multi-Threaded-CVE-2018-28Third Party AdvisoryVDB Entry
- http://seclists.org/fulldisclosure/2019/Apr/28Mailing ListThird Party Advisory
- http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.htmlPatchVendor Advisory
- http://www.securityfocus.com/bid/103788Third Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1040695Third Party AdvisoryVDB Entry
- https://github.com/MostafaSoliman/Oracle-OAM-Padding-Oracle-CVE-2018-2879-ExploiProductThird Party Advisory
- https://seclists.org/bugtraq/2019/Apr/27Mailing ListThird Party Advisory
- https://www.sec-consult.com/en/blog/2018/05/oracle-access-managers-identity-crisExploitThird Party Advisory
- http://packetstormsecurity.com/files/152551/OAMbuster-Multi-Threaded-CVE-2018-28Third Party AdvisoryVDB Entry
- http://seclists.org/fulldisclosure/2019/Apr/28Mailing ListThird Party Advisory
- http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.htmlPatchVendor Advisory
- http://www.securityfocus.com/bid/103788Third Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1040695Third Party AdvisoryVDB Entry
- https://github.com/MostafaSoliman/Oracle-OAM-Padding-Oracle-CVE-2018-2879-ExploiProductThird Party Advisory
- https://seclists.org/bugtraq/2019/Apr/27Mailing ListThird Party Advisory
FAQ
What is CVE-2018-2879?
CVE-2018-2879 is a vulnerability with a CVSS score of 9.0 (CRITICAL). Vulnerability in the Oracle Access Manager component of Oracle Fusion Middleware (subcomponent: Authentication Engine). Supported versions that are affected are 11.1.2.3.0 and 12.2.1.3.0. Difficult to...
How severe is CVE-2018-2879?
CVE-2018-2879 has been rated CRITICAL with a CVSS base score of 9.0/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2018-2879?
Check the references section above for vendor advisories and patch information. Affected products include: Oracle Access Manager.