WaratekVRT Sign in

CVE-2018-2879 Oracle Access Manager

Affected softwareOracle Access Manager
Affected versions11.1.2.3.0, 12.2.1.3.0
Severity9.0 Critical CVSS 3.0 2 scores
Fixed inOracle Critical Patch Update April 2018
Published19 Apr 2018
Updated17 Jun 2026

Description

Vulnerability in the Oracle Access Manager component of Oracle Fusion Middleware (subcomponent: Authentication Engine). Supported versions that are affected are 11.1.2.3.0 and 12.2.1.3.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. While the vulnerability is in Oracle Access Manager, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. Note: Please refer to Doc ID <a href="http://support.oracle.com/CSP/main/article?cmd=show&type=NOT&id=2386496.1">My Oracle Support Note 2386496.1 for instructions on how to address this issue. CVSS 3.0 Base Score 9.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H).

Exploitation status

Proof of concept only

A proof of concept exists, but no reviewed exploit catalogue lists this CVE.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment exploitation: none
  • Indexed PoC 2 indexed Published artifacts you can open, in GitHub PoC; first seen 2018-07-26.
  • EPSS 21% chance in 30 days A model's forecast, not a report of exploitation. Higher than 98% of all scored CVEs.
IndexArtifactStarsFirst seen
GitHub PoC MostafaSoliman/Oracle-OAM-Padding-Oracle-CVE-2018-2879-Exploit 11 2018-07-26
GitHub PoC Exploit for Oracle Access Manager padding oracle vulnerability (CVE-2018-2879) 7 2018-07-29

Waratek protection

Protected by Waratek

Waratek has a rule that blocks attacks on this vulnerability.

  • Protection full
  • Action available patch rule
  • Review human ARMR file
  • Record active
Decided by An ARMR patch file on disk for this CVE
Finding CVE has an ARMR patch rule that provides mitigation

ARMR rule files

1 file

The rule files Waratek ships for this CVE. Some CVEs need more than one, for example one per affected library or one per ARMR version.

CVE-2018-2879.armr patch rule, ARMR 2.6 added 2020-06-25 updated 2026-03-04
Sign in to download

How to mitigate CVE-2018-2879

Apply the fix in Oracle Critical Patch Update April 2018. Until you can, Waratek RASP blocks exploitation with a rule written for this CVE. It runs inside the Java application, with no code changes.

Waratek RASP Runtime protection for Java applications

CVSS

9.0 CRITICAL v3.0 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.0 9.0 CRITICAL CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H NVD Primary published
CVSS 2.0 6.8 none AV:N/AC:M/Au:N/C:P/I:P/A:P NVD Primary

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update April 2018 ↗ CPU 2018-Q2 Oracle Fusion Middleware / Authentication Engine (11.1.2.3.0, 12.2.1.3.0)
Oracle's note: Please refer to Doc ID My Oracle Support Note 2386496.1 for instructions on how to address this issue.

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Fusion Middleware Authentication Engine 11.1.2.3.0, 12.2.1.3.0 11.1.2.3.0 · 12.2.1.3.0

Products and versions

1 product, 2 version entries
SourceVendorProductSchemeAffected versions
nvd oracle access manager generic 11.1.2.3.0 · 12.2.1.3.0

References

URLTags
http://packetstormsecurity.com/files/152551/OAMbuster-Multi-Threaded-CVE-2018-2879-Scanner.html Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2019/Apr/28 Mailing List, Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html Patch, Vendor Advisory
http://www.securityfocus.com/bid/103788 Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1040695 Third Party Advisory, VDB Entry
https://github.com/MostafaSoliman/Oracle-OAM-Padding-Oracle-CVE-2018-2879-Exploit Product, Third Party Advisory
https://seclists.org/bugtraq/2019/Apr/27 Mailing List, Third Party Advisory
https://www.sec-consult.com/en/blog/2018/05/oracle-access-managers-identity-crisis/ Exploit, Third Party Advisory

Timeline
Published2018-04-19By the CVE Program.
ARMR remediation created2020-06-25Earliest commit adding this CVE's ARMR patch or security rule.
ARMR remediation last updated2026-03-04Most recent commit touching this CVE's ARMR patch or security rule.
Last VRT activity2026-03-04Most recent commit touching this CVE's classification, patch or rule file.
NVD record modified2026-06-17NVD's own last-modified date for this record.