What is the CVSS score of CVE-2018-1000613?

CVE-2018-1000613 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 4.8%.

Is there a patch available for CVE-2018-1000613?

Yes, a patch is available for CVE-2018-1000613. Update the affected software to the latest version immediately.

Java CVE-2018-1000613

CRITICAL

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') (CWE-470)

2018-07-09 cve@mitre.org

Java Deserialization Bc Java Oncommand Workflow Automation Leap Api Gateway Banking Platform Business Process Management Suite Business Transaction Management Communications Application Session Controller Communications Converged Application Server Communications Convergence Communications Diameter Signaling Router Communications Webrtc Session Controller Data Integrator Enterprise Manager Base Platform Enterprise Manager For Fusion Middleware Enterprise Repository Managed File Transfer Peoplesoft Enterprise Peopletools Retail Convenience And Fuel Pos Software Retail Xstore Point Of Service Soa Suite Utilities Network Management System Webcenter Portal Weblogic Server

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

Jul 09, 2018 - 20:29 nvd

CRITICAL 9.8

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1,065 maven packages depend on org.bouncycastle:bcprov-jdk15on (127 direct, 940 indirect)

Ecosystem-wide dependent count for version 1.57.

DescriptionNVD

Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to but not including 1.60 contains a CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in XMSS/XMSS^MT private key deserialization that can result in Deserializing an XMSS/XMSS^MT private key can result in the execution of unexpected code. This attack appear to be exploitable via A handcrafted private key can include references to unexpected classes which will be picked up from the class path for the executing application. This vulnerability appears to have been fixed in 1.60 and later.

AnalysisAI

Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to but not including 1.60 contains a CWE-470: Use of Externally-Controlled Input to Select Classes or Code. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Technical ContextAI

This vulnerability is classified under CWE-470. Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to but not including 1.60 contains a CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in XMSS/XMSS^MT private key deserialization that can result in Deserializing an XMSS/XMSS^MT private key can result in the execution of unexpected code. This attack appear to be exploitable via A handcrafted private key can include references to unexpected classes which will be picked up from the class path for the executing application. This vulnerability appears to have been fixed in 1.60 and later. Affected products include: Bouncycastle Bc-Java, Netapp Oncommand Workflow Automation, Opensuse Leap, Oracle Api Gateway, Oracle Banking Platform.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.