PT-2018-2255 · Oracle · Oracle Identity Manager

Published 2018-10-16 · Updated 2019-10-03 · CVE-2018-3179

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L

Name of the Vulnerable Software and Affected Versions Oracle Identity Manager versions 11.1.2.3.0 through 12.2.1.3.0

Description The issue is related to insufficient access control in the Advanced Console component of Oracle Identity Manager. This can be exploited by a remote attacker to gain unauthorized access to protected data or cause a denial of service using the HTTP protocol. The vulnerability can result in unauthorized read access to a subset of Oracle Identity Manager accessible data and the ability to cause a partial denial of service of Oracle Identity Manager.

Recommendations For versions 11.1.2.3.0 and 12.2.1.3.0, consider restricting access to the Advanced Console component until a patch is available. As a temporary workaround, consider disabling the use of the HTTP protocol for the Advanced Console component to minimize the risk of exploitation. Restrict network access to the Oracle Identity Manager component to minimize the risk of unauthorized access.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2019-00353

CVE-2018-3179

Affected Products

Oracle Identity Manager

References · 6

• https://osv.dev/vulnerability/CVE-2018-3179 · Vendor Advisory
• http://oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-00353 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-3179 · Security Note
• https://securityfocus.com/bid/105636 · Note
• http://securityfocus.com/bid/105636 · Note