High severity · published Jul 18, 2018
CVE-2018-3007
Vulnerability in the Oracle Tuxedo component of Oracle Fusion Middleware (subcomponent: Core)
8.6
CVSS
2.7%
EPSS
No
On KEV
Description
Vulnerability in the Oracle Tuxedo component of Oracle Fusion Middleware (subcomponent: Core). Supported versions that are affected are 12.1.1, 12.1.3 and 12.2.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via Jolt to compromise Oracle Tuxedo. While the vulnerability is in Oracle Tuxedo, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Tuxedo accessible data. CVSS 3.0 Base Score 8.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)2.7% · higher than 86% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TU
Tuxedo · Oracle
12.1.1; 12.1.3; 12.2.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-3007
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-3007
Patch
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
Third Party Advisory
http://www.securityfocus.com/bid/104814
Third Party Advisory
http://www.securitytracker.com/id/1041310
More from Tuxedo
10.0
CVE-2017-10269
Vulnerability in the Oracle Tuxedo component of Oracle Fusion Middleware (subcomponent: Core)
9.9
CVE-2017-10272
Vulnerability in the Oracle Tuxedo component of Oracle Fusion Middleware (subcomponent: Core)
9.8
CVE-2022-23305
By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout
8.8
CVE-2022-23307
CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw
8.8
CVE-2022-23302
JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration…