PT-2018-2255 · Oracle · Oracle Identity Manager

Publicado 2018-10-16 · Atualizado 2019-10-03 · CVE-2018-3179

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L

Name of the Vulnerable Software and Affected Versions Oracle Identity Manager versions 11.1.2.3.0 through 12.2.1.3.0

Description The issue is related to insufficient access control in the Advanced Console component of Oracle Identity Manager. This can be exploited by a remote attacker to gain unauthorized access to protected data or cause a denial of service using the HTTP protocol. The vulnerability can result in unauthorized read access to a subset of Oracle Identity Manager accessible data and the ability to cause a partial denial of service of Oracle Identity Manager.

Recommendations For versions 11.1.2.3.0 and 12.2.1.3.0, consider restricting access to the Advanced Console component until a patch is available. As a temporary workaround, consider disabling the use of the HTTP protocol for the Advanced Console component to minimize the risk of exploitation. Restrict network access to the Oracle Identity Manager component to minimize the risk of unauthorized access.

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

BDU:2019-00353

CVE-2018-3179

Produtos afetados

Oracle Identity Manager

Referências · 6

• https://osv.dev/vulnerability/CVE-2018-3179 · Aviso do Fabricante
• https://securityfocus.com/bid/105636 · Nota
• http://oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2019-00353 · Nota de Segurança
• http://securityfocus.com/bid/105636 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-3179 · Nota de Segurança