Vulnerabilities > CVE-2018-2739 - Unspecified vulnerability in Oracle Access Manager 10.1.4.3.0/11.1.2.3.0/12.2.1.3.0

047910
CVSS 9.3 - CRITICAL
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
HIGH
Integrity impact
HIGH
Availability impact
NONE
network
low complexity
oracle
critical
nessus
NVD
Published: 2018-04-19
Updated: 2024-11-21

Summary

Vulnerability in the Oracle Access Manager component of Oracle Fusion Middleware (subcomponent: Web Server Plugin). Supported versions that are affected are 10.1.4.3.0, 11.1.2.3.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Access Manager, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Access Manager accessible data as well as unauthorized access to critical data or complete access to all Oracle Access Manager accessible data. CVSS 3.0 Base Score 9.3 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N).

Vulnerable Configurations

Part Description Count
Application
Oracle
3

Nessus

NASL familyMisc.
NASL idORACLE_ACCESS_MANAGER_CPU_APR_2018.NASL
descriptionThe version of Oracle Access Manager installed on the remote host is affected by multiple vulnerabilities.
last seen2020-06-01
modified2020-06-02
plugin id109733
published2018-05-11
reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
sourcehttps://www.tenable.com/plugins/nessus/109733
titleOracle Access Manager Multiple Vulnerabilities (Apr 2018 CPU)
code
#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(109733);
  script_version("1.4");
  script_cvs_date("Date: 2019/04/30 14:30:16");

  script_cve_id("CVE-2018-2739","CVE-2018-2879","CVE-2018-2587");
  script_bugtraq_id(103784,103788,103822);

  script_name(english:"Oracle Access Manager Multiple Vulnerabilities (Apr 2018 CPU)");
  script_summary(english:"Checks installed patch/version info.");

  script_set_attribute(attribute:"synopsis", value:
"The remote host has a Single Sign On (SSO) application installed that
is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of Oracle Access Manager installed on the remote host is
affected by multiple vulnerabilities.");
  # https://www.oracle.com/technetwork/topics/security/cpuapr2018-3678067.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?50aa8cea");
  script_set_attribute(attribute:"solution", value:
"Apply the appropriate patches according to the April 2018 Oracle
Critical Patch Update advisory.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2018/04/17");
  script_set_attribute(attribute:"patch_publication_date", value:"2018/04/17");
  script_set_attribute(attribute:"plugin_publication_date", value:"2018/05/11");

  script_set_attribute(attribute:"plugin_type", value:"local");

  script_set_attribute(attribute:"cpe", value:"cpe:/a:oracle:fusion_middleware");

  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("oracle_access_manager_installed.nbin");
  script_require_keys("Oracle/OAM/Installed");

  exit(0);
}

include("audit.inc");
include("global_settings.inc");
include("oracle_rdbms_cpu_func.inc");
include("misc_func.inc");

get_kb_item_or_exit("Oracle/OAM/Installed");
installs = get_kb_list_or_exit("Oracle/OAM/*/Version");
product = "Oracle Access Manager";

path = branch(keys(installs));
report = NULL;

version = installs[path];
path = path - "Oracle/OAM/" - "/Version";

if (version =~ "^10\.1\.4\.3(\.|$)")
  fixed = "10.1.4.3.0.13"; # according to the info in the patch file: install_info
else if (version =~ "^11\.1\.2\.3(\.|$)")
  fixed = "11.1.2.3.180417";
else if (version =~ "^12\.2\.1\.3(\.|$)")
  fixed = "12.2.1.3.180414"; # the 14 aligns w/ the release notes
else
  audit(AUDIT_INST_PATH_NOT_VULN, product, version, path);

if (ver_compare(ver:version, fix:fixed, strict:FALSE) >= 0) audit(AUDIT_INST_PATH_NOT_VULN, product, version, path);

report =
   '\n  The following vulnerable version of ' + product + ' was found' +
   '\n  on the remote host : ' +
   '\n' +
   '\n  Path              : ' + path +
   '\n  Installed version : ' + version +
   '\n  Fixed version     : ' + fixed +
   '\n';

security_report_v4(port:0, extra:report, severity:SECURITY_WARNING);

References