CVE-2018-2587
published 2018-04-19CVE-2018-2587: Vulnerability in the Oracle Access Manager component of Oracle Fusion Middleware (subcomponent: Web Server Plugin). Supported versions that are affected are…
PriorityP341medium6.5CVSS 3.1
AVNACHPRNUINSUCLIHAN
EPSS
2.05%
79.0th percentile
Vulnerability in the Oracle Access Manager component of Oracle Fusion Middleware (subcomponent: Web Server Plugin). Supported versions that are affected are 10.1.4.3.0, 11.1.2.3.0 and 12.2.1.3.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Access Manager accessible data as well as unauthorized read access to a subset of Oracle Access Manager accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N).
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| oracle | access_manager | — | — |
| oracle | access_manager | — | — |
| oracle | access_manager | — | — |
| oracle | adaptive_access_manager | — | — |
| oracle_corporation | access_manager | — | — |
| oracle_corporation | access_manager | — | — |
| oracle_corporation | access_manager | — | — |
| oracle_corporation | adaptive_access_manager | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N
nvdv2.05.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:N
vendor_oracle6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-98hv-cvvr-jhw3: Vulnerability in the Oracle Access Manager component of Oracle Fusion Middleware (subcomponent: Web Server Plugin)
ghsa_unreviewed·2022-05-13
CVE-2018-2587 [MEDIUM] GHSA-98hv-cvvr-jhw3: Vulnerability in the Oracle Access Manager component of Oracle Fusion Middleware (subcomponent: Web Server Plugin)
Vulnerability in the Oracle Access Manager component of Oracle Fusion Middleware (subcomponent: Web Server Plugin). Supported versions that are affected are 10.1.4.3.0, 11.1.2.3.0 and 12.2.1.3.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Access Manager accessible data as well as unauthorized read access to a subset of Oracle Access Manager accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N).
Oracle
Oracle Oracle Fusion Middleware Risk Matrix: Install and Config — CVE-2018-2587
vendor_oracle·2021-01-15·CVSS 6.5
CVE-2018-2587 [MEDIUM] Oracle Oracle Fusion Middleware Risk Matrix: Install and Config — CVE-2018-2587
Oracle Oracle Fusion Middleware Risk Matrix: Install and Config vulnerability
CVE: CVE-2018-2587
CVSS: 6.5
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujan2021 (JAN 2021)
No detection rules found.
No public exploits indexed.
http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.htmlhttp://www.securityfocus.com/bid/103822http://www.securitytracker.com/id/1040695https://www.oracle.com/security-alerts/cpujan2021.htmlhttp://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.htmlhttp://www.securityfocus.com/bid/103822http://www.securitytracker.com/id/1040695https://www.oracle.com/security-alerts/cpujan2021.html
2018-04-19
Published