Attacker Value

Unknown

(0 users assessed)

Exploitability

Unknown

(0 users assessed)

User Interaction

None

Privileges Required

None

Attack Vector

Network

0

CVE-2018-2796

Disclosure Date: April 19, 2018 •

CVE-2018-2796 CVSS v3 Base Score: 5.3

MITRE ATT&CK

Add MITRE ATT&CK tactics and techniques that apply to this CVE.

Description

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Concurrency). Supported versions that are affected are Java SE: 7u171, 8u162 and 10; Java SE Embedded: 8u161; JRockit: R28.3.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

Add Assessment

No one has assessed this topic. Be the first to add your voice to the community.

CVSS V3 Severity and Metrics

Data provided by the National Vulnerability Database (NVD)

Base Score:

5.3 Medium

Impact Score:

1.4

Exploitability Score:

3.9

Vector:

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Attack Vector (AV):

Network

Attack Complexity (AC):

Low

Privileges Required (PR):

None

User Interaction (UI):

None

Scope (S):

Unchanged

Confidentiality (C):

None

Integrity (I):

None

Availability (A):

Low

Vendors

Oracle Corporation

Products

Java

References

Canonical

CVE-2018-2796 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2796)

BID-103868 (http://www.securityfocus.com/bid/103868)

Advisory

https://access.redhat.com/errata/RHSA-2018:1278

DSA-4185 (https://www.debian.org/security/2018/dsa-4185)

https://access.redhat.com/errata/RHSA-2018:1975

https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03857en_us

GLSA-201903-14 (https://security.gentoo.org/glsa/201903-14)

DSA-4225 (https://www.debian.org/security/2018/dsa-4225)

SECTRACK-1040697 (http://www.securitytracker.com/id/1040697)

https://access.redhat.com/errata/RHSA-2018:1724

USN-3644-1 (https://usn.ubuntu.com/3644-1)

https://access.redhat.com/errata/RHSA-2018:1723

https://security.netapp.com/advisory/ntap-20180419-0001

https://access.redhat.com/errata/RHSA-2018:1201

https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0

https://access.redhat.com/errata/RHSA-2018:1204

http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html

https://access.redhat.com/errata/RHSA-2018:1722

https://access.redhat.com/errata/RHSA-2018:1974

https://access.redhat.com/errata/RHSA-2018:1721

USN-3691-1 (https://usn.ubuntu.com/3691-1)

https://access.redhat.com/errata/RHSA-2018:1202

https://access.redhat.com/errata/RHSA-2018:1191

https://access.redhat.com/errata/RHSA-2018:1188

https://access.redhat.com/errata/RHSA-2018:1206

https://access.redhat.com/errata/RHSA-2018:1270

https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03915en_us

Rapid7

Technical Analysis