PT-2018-2229 · Oracle+1 · Java Se+3

Published 2018-10-16 · Updated 2022-06-27 · CVE-2018-3209

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Java SE version 8u182

Description The issue is related to insufficient access control in the JavaFX component of Java SE, which can be exploited by a remote attacker to gain full control over the application. The vulnerability is difficult to exploit and requires human interaction from a person other than the attacker. It can compromise Java SE and may significantly impact additional products. This issue applies to Java deployments that load and run untrusted code, such as sandboxed Java Web Start applications or sandboxed Java applets, and rely on the Java sandbox for security.

Recommendations For Java SE version 8u182, update to a version that contains a fix for this issue to prevent exploitation. As a temporary workaround, consider restricting the use of the JavaFX component until a patch is available. Additionally, ensure that only trusted code is loaded and run on servers to minimize the risk of exploitation.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2019-00273

CVE-2018-3209

RHSA-2018:3002

RHSA-2018:3003

RHSA-2018_3002

RHSA-2018_3003

Affected Products

Java Platform

Java Se

Javafx

Red Hat

References · 15

• https://ubuntu.com/security/CVE-2018-3209 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-3209 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:3002 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-3209 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-3209 · Security Note
• https://cve.org/CVERecord?id=CVE-2018-3209 · Security Note
• http://oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-3209 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-00273 · Security Note
• https://security.gentoo.org/glsa/201908-10 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-3209 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:3003 · Vendor Advisory
• http://securityfocus.com/bid/105590 · Note
• http://securitytracker.com/id/1041889 · Note
• https://security.netapp.com/advisory/ntap-20181018-0001 · Note