PT-2018-3605 · Oracle · Oracle Access Manager+1

Published 2018-04-18 · Updated 2021-01-30 · CVE-2018-2587

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:M/Au:N/C:P/I:C/A:N

Name of the Vulnerable Software and Affected Versions Oracle Access Manager versions 10.1.4.3.0, 11.1.2.3.0, 12.2.1.3.0

Description The issue is related to the Web Server Plugin component of Oracle Access Manager in Oracle Fusion Middleware, which can be exploited by an unauthenticated attacker with network access via HTTP. This allows the attacker to compromise Oracle Access Manager, resulting in unauthorized creation, deletion, or modification access to critical data or all accessible data, as well as unauthorized read access to a subset of accessible data. The vulnerability is difficult to exploit and is related to the lack of protection for service data.

Recommendations For version 10.1.4.3.0, update to a fixed version to resolve the issue. For version 11.1.2.3.0, update to a fixed version to resolve the issue. For version 12.2.1.3.0, update to a fixed version to resolve the issue. As a temporary workaround, consider restricting access to the Web Server Plugin component until a patch is available.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2021-01067

CVE-2018-2587

Affected Products

Oracle Access Manager

Oracle Fusion Middleware

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2018-2587 · Security Note
• https://bdu.fstec.ru/vul/2021-01067 · Security Note
• http://oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-2587 · Vendor Advisory
• http://securitytracker.com/id/1040695 · Note
• https://oracle.com/security-alerts/cpujan2021.html · Note
• http://securityfocus.com/bid/103822 · Note