VRT 391,192 CVEs tracked · 15,442 in RASP scope · data as of 18 hours ago

CVE-2018-2602

4.5 Medium Mitigated by environment configuration

Description

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: I18n). Supported versions that are affected are Java SE: 6u171, 7u161, 8u152 and 9.0.1; Java SE Embedded: 8u151. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Java SE, Java SE Embedded executes to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well as unauthorized read access to a subset of Java SE, Java SE Embedded accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 4.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L).

Exploitation Status

No public exploit

Nothing published shows this CVE being exploited, which is not the same as ruling it out. nothing published in 8 years.

CVSS E:U

  • CISA KEV not listed
  • CISA Vulnrichment exploitation: none
  • Indexed PoC none indexed
  • EPSS 0.63% chance in 30 days

Waratek Defense Posture

Mitigated by environment configuration

The vulnerability is mitigated through deployment or application configuration rather than by an ARMR rule. This is a historical determination; the specific configuration change may not be recorded.

  • Protection full the deployment environment, not the agent
  • Action not-needed
  • Review human manual-review
  • Record active
Decided by manual classification : Manual classification of this CVE in the legacy dataset
Finding Manual classification assigned status: MITIGATED-BY-ENVIRONMENT

CVSS

4.5 MEDIUM v3.1 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L 2 metrics

VRT selects the newest version's highest entry and publishes it as cvssScore, newest rather than largest because scores are not comparable across versions, and highest rather than first because the first entry is frequently a CNA placeholder scoring 0.0 over NVD's own analysis.

VersionScoreBandVectorAssignerType
CVSS 3.1 4.5 MEDIUM CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L NVD Primary published
CVSS 2.0 3.7 no band published AV:L/AC:H/Au:N/C:P/I:P/A:P NVD Primary

Affected Software & Releases

🏛️ Oracle CPU Advisories & Products

AdvisoryTypeQuarterProducts Oracle named in risk matrix
Oracle Critical Patch Update January 2018 ↗ CPU 2018-Q1 Oracle Java SE / I18n (Java SE: 6u171, 7u161, 8u152, 9.0.1; Java SE Embedded: 8u151)

Indexed Oracle Components & Versions

FamilyComponentOracle's version cell (verbatim)Indexed as
Oracle Java SE I18n Java SE: 6u171, 7u161, 8u152, 9.0.1; Java SE Embedded: 8u151 6.0.171.0 · 7.0.161.0 · 8.0.151.0 · 8.0.152.0 · 9.0.1.0

🖥️ Product CPEs & Version Ranges

15 product(s) over 34 version claims (uncapped)
SourceVendorProductSchemeAffected Versions
nvd canonical ubuntu linux generic 14.04 · 16.04 · 17.10
nvd debian debian linux generic 7.0 · 8.0 · 9.0
nvd hp xp command view generic ≥ 8.6.2.1
nvd hp xp p9000 command view generic ≥ 8.6.2.1
nvd hp xp7 command view generic ≥ 8.6.2.1
nvd oracle jdk javase 1.6.0:update171 · 1.7.0:update161 · 1.8.0:update152 · 9.0.1
nvd oracle jre javase 1.6.0:update171 · 1.7.0:update161 · 1.8.0:update152 · 9.0.1
nvd redhat enterprise linux desktop generic 6.0 · 7.0
nvd redhat enterprise linux server generic 6.0 · 7.0
nvd redhat enterprise linux server aus generic 7.4 · 7.6
nvd redhat enterprise linux server eus generic 7.4 · 7.5 · 7.6
nvd redhat enterprise linux server tus generic 7.4 · 7.6
nvd redhat enterprise linux workstation generic 6.0 · 7.0
nvd redhat satellite generic 5.6 · 5.7 · 5.8
nvd schneider-electric struxureware data center expert generic ＜ 7.6.0

Manual classification context

A reviewer manually classified this CVE. The retained record includes the labels and products below, but not the reviewer's reasoning.

## Manual Classification Context **Labels:** SEE NOTE 1, I18N **Products:** JAVA SE EMBEDDED, OPENJDK, JAVA SE, ORACLE JAVA SE

References

URLTags
https://access.redhat.com/errata/RHSA-2018:0095 ADVISORY, RHSA-2018:0095
https://access.redhat.com/security/cve/CVE-2018-2602 REPORT, RHSA-2018:0095
https://access.redhat.com/errata/RHSA-2018:0099 ADVISORY, RHSA-2018:0099
https://access.redhat.com/errata/RHSA-2018:0349 ADVISORY, RHSA-2018:0349
https://access.redhat.com/errata/RHSA-2018:0351 ADVISORY, RHSA-2018:0351
https://access.redhat.com/errata/RHSA-2018:0352 ADVISORY, RHSA-2018:0352
https://access.redhat.com/errata/RHSA-2018:1463 ADVISORY, RHSA-2018:1463
http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html Patch
http://www.securityfocus.com/bid/102642 Broken Link, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1040203 Broken Link, Third Party Advisory, VDB Entry

Timeline

Published 2018-01-18 Last modified 2026-06-17
Published2018-01-18By the CVE Program.
NVD record modified2026-06-17NVD's own last-modified date for this record.