What is the CVSS score of CVE-2018-2739?

CVE-2018-2739 has a CVSS 3.0 base score of 9.3 (Critical). CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 2.3%.

Is there a patch available for CVE-2018-2739?

Yes, a patch is available for CVE-2018-2739. Update the affected software to the latest version immediately.

Access Manager CVE-2018-2739

CRITICAL

2018-04-19 secalert_us@oracle.com

Oracle Authentication Bypass Access Manager

9.3

CVSS 3.0 · NVD

Severity by source

NVD PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

CVE Published

Apr 19, 2018 - 02:29 nvd

CRITICAL 9.3

DescriptionNVD

Vulnerability in the Oracle Access Manager component of Oracle Fusion Middleware (subcomponent: Web Server Plugin). Supported versions that are affected are 10.1.4.3.0, 11.1.2.3.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Access Manager, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Access Manager accessible data as well as unauthorized access to critical data or complete access to all Oracle Access Manager accessible data. CVSS 3.0 Base Score 9.3 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N).

AnalysisAI

Vulnerability in the Oracle Access Manager component of Oracle Fusion Middleware (subcomponent: Web Server Plugin). Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Technical ContextAI

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Access Manager

View all

CVE-2020-2555 CRITICAL Act Now POC

9.8 Jan 15

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation). Ra

CVE-2018-10197 CRITICAL Act Now POC

9.8 Jul 11

There is a time-based blind SQL injection vulnerability in the Access Manager component before 9.18.040 and 10.x before

CVE-2018-2879 CRITICAL Act Now POC

9.0 Apr 19

Vulnerability in the Oracle Access Manager component of Oracle Fusion Middleware (subcomponent: Authentication Engine).

CVE-2014-5217 MEDIUM This Month POC

6.8 Dec 23

Cross-site request forgery (CSRF) vulnerability in nps/servlet/webacc in the Administration Console server in NetIQ Acce

CVE-2014-5216 MEDIUM This Month POC

4.3 Dec 23

Multiple cross-site scripting (XSS) vulnerabilities in NetIQ Access Manager (NAM) 4.x before 4.0.1 HF3 allow remote atta

CVE-2019-10219 MEDIUM This Month POC

6.1 Nov 08

A vulnerability was found in Hibernate-Validator. Rated medium severity (CVSS 6.1), this vulnerability is remotely explo

CVE-2016-5757 CRITICAL Act Now

9.8 Mar 23

iManager Admin Console in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 was vulnerable to iFrame

CVE-2014-9412 MEDIUM This Month POC

4.3 Dec 23

Multiple cross-site scripting (XSS) vulnerabilities in NetIQ Access Manager (NAM) 4.x before 4.1 allow remote attackers

CVE-2018-1342 CRITICAL Act Now

9.8 Jan 26

A Vulnerability exists on Admin Console where an attacker can upload files to the Admin Console server, and potentially

CVE-2016-5750 HIGH This Week

8.8 Mar 23

The certificate upload feature in iManager in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 could

CVE-2016-5758 HIGH This Week

8.8 Mar 23

A cross site request forgery protection mechanism in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.

CVE-2021-29425 MEDIUM This Month POC

4.8 Apr 13

In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "/

Same technique Authentication Bypass

View all

CVE-2023-22515 CRITICAL POC

9.8

CVE-2012-4681 CRITICAL POC

9.8

CVE-2013-2465 CRITICAL POC

9.8

CVE-2011-3544 CRITICAL POC

9.8

CVE-2012-1723 CRITICAL POC

9.8

CVE-2017-10271 HIGH POC

7.5

CVE-2015-1427 CRITICAL POC

9.8

CVE-2025-3248 CRITICAL POC

9.8

CVE-2018-2739 vulnerability details – vuln.today

Back