CVE-2018-2879

4 documents4 sources
Severity
9.0CRITICAL
EPSS
44.5%
top 2.44%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Oracle Corporation Access ManagerOracle Access Manager
Timeline
PublishedApr 19
Latest updateMay 13

Description

Vulnerability in the Oracle Access Manager component of Oracle Fusion Middleware (subcomponent: Authentication Engine). Supported versions that are affected are 11.1.2.3.0 and 12.2.1.3.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. While the vulnerability is in Oracle Access Manager, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracl…

CVSS vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:HExploitability: 2.2 | Impact: 6.0

Affected Packages2 packages

▶NVDoracle/access_manager11.1.2.3.0, 12.2.1.3.0+1
▶CVEListV5oracle_corporation/access_manager11.1.2.3.0, 12.2.1.3.0+1

Patches

Patch: www.oracle.com ↗Patch: www.oracle.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-5xgp-rmw9-5cfw: Vulnerability in the Oracle Access Manager component of Oracle Fusion Middleware (subcomponent: Authentication Engine)↗2022-05-13
▶
CVEList
CVE-2018-2879: Vulnerability in the Oracle Access Manager component of Oracle Fusion Middleware (subcomponent: Authentication Engine)↗2018-04-19
▶

💬Community

1
HackerOne
[HTAF4-213] [Pre-submission] CVE-2018-2879 (padding oracle attack in the Oracle Access Manager) at https://█████████↗2021-07-29
▶