Lucene search

OracleCVE-2018-2940

HistoryJul 18, 2018 - 1:29 p.m.

CVE-2018-2940

2018-07-1813:29:02

oracle

web.nvd.nist.gov

177

cve-2018-2940

oracle java se

vulnerability

unauthorized access

java

security advisory

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

AI Score

4.2

Confidence

High

EPSS

0.003

Percentile

71.1%

JSON

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE: 6u191, 7u181, 8u172 and 10.0.1; Java SE Embedded: 8u171. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N).

Affected configurations

Nvd

Vulners

Node

oraclejdkMatch1.6.0update191

oraclejdkMatch1.7.0update181

oraclejdkMatch1.8.0update172

oraclejdkMatch10.0.1

oraclejreMatch1.6.0update191

oraclejreMatch1.7.0update181

oraclejreMatch1.8.0update172

oraclejreMatch10.0.1

Node

hpxp7_command_viewadvanced

Node

redhatsatelliteMatch5.6

redhatsatelliteMatch5.7

redhatsatelliteMatch5.8

redhatenterprise_linux_desktopMatch6.0

redhatenterprise_linux_desktopMatch7.0

redhatenterprise_linux_serverMatch6.0

redhatenterprise_linux_serverMatch7.0

redhatenterprise_linux_workstationMatch6.0

redhatenterprise_linux_workstationMatch7.0

Node

netappactive_iq_unified_managerMatch-vmware_vsphere

netappactive_iq_unified_managerMatch-windows

netappcloud_backupMatch-

netappe-series_santricity_os_controllerRange11.0–11.70.1

netappe-series_santricity_storage_managerMatch-

netapponcommand_insightMatch-

netapponcommand_unified_managerMatch-

netapponcommand_workflow_automationMatch-

netappplug-in_for_symantec_netbackupMatch-

netappsnapmanagerMatch-oracle

netappsnapmanagerMatch-sap

netappsteelstore_cloud_integrated_storageMatch-

netappstorage_replication_adapter_for_clustered_data_ontapRange9.7≥vmware_vsphere

netappvasa_provider_for_clustered_data_ontapRange9.7≥

netappvirtual_storage_consoleRange9.7≥vmware_vsphere

VendorProductVersionCPE
oraclejdk1.6.0cpe:2.3:a:oracle:jdk:1.6.0:update191:*:*:*:*:*:*
oraclejdk1.7.0cpe:2.3:a:oracle:jdk:1.7.0:update181:*:*:*:*:*:*
oraclejdk1.8.0cpe:2.3:a:oracle:jdk:1.8.0:update172:*:*:*:*:*:*
oraclejdk10.0.1cpe:2.3:a:oracle:jdk:10.0.1:*:*:*:*:*:*:*
oraclejre1.6.0cpe:2.3:a:oracle:jre:1.6.0:update191:*:*:*:*:*:*
oraclejre1.7.0cpe:2.3:a:oracle:jre:1.7.0:update181:*:*:*:*:*:*
oraclejre1.8.0cpe:2.3:a:oracle:jre:1.8.0:update172:*:*:*:*:*:*
oraclejre10.0.1cpe:2.3:a:oracle:jre:10.0.1:*:*:*:*:*:*:*
hpxp7_command_view*cpe:2.3:a:hp:xp7_command_view:*:*:*:*:advanced:*:*:*
redhatsatellite5.6cpe:2.3:a:redhat:satellite:5.6:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
oracle	jdk	1.6.0	cpe:2.3:a:oracle:jdk:1.6.0:update191::::::
oracle	jdk	1.7.0	cpe:2.3:a:oracle:jdk:1.7.0:update181::::::
oracle	jdk	1.8.0	cpe:2.3:a:oracle:jdk:1.8.0:update172::::::
oracle	jdk	10.0.1	cpe:2.3:a:oracle:jdk:10.0.1:::::::*
oracle	jre	1.6.0	cpe:2.3:a:oracle:jre:1.6.0:update191::::::
oracle	jre	1.7.0	cpe:2.3:a:oracle:jre:1.7.0:update181::::::
oracle	jre	1.8.0	cpe:2.3:a:oracle:jre:1.8.0:update172::::::
oracle	jre	10.0.1	cpe:2.3:a:oracle:jre:10.0.1:::::::*
hp	xp7_command_view	*	cpe:2.3:a:hp:xp7_command_view:::::advanced:::*
redhat	satellite	5.6	cpe:2.3:a:redhat:satellite:5.6:::::::*

Rows per page:

1-10 of 331

CNA Affected

[
  {
    "product": "Java",
    "vendor": "Oracle Corporation",
    "versions": [
      {
        "status": "affected",
        "version": "Java SE: 6u191"
      },
      {
        "status": "affected",
        "version": "7u181"
      },
      {
        "status": "affected",
        "version": "8u172"
      },
      {
        "status": "affected",
        "version": "10.0.1; Java SE Embedded: 8u171"
      }
    ]
  }
]