Attacker Value

Unknown

(0 users assessed)

Exploitability

Unknown

(0 users assessed)

User Interaction

Required

Privileges Required

None

Attack Vector

Local

0

CVE-2018-2794

Disclosure Date: April 19, 2018 •

CVE-2018-2794 CVSS v3 Base Score: 7.7

MITRE ATT&CK

Add MITRE ATT&CK tactics and techniques that apply to this CVE.

Description

Vulnerability in the Java SE, JRockit component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 6u181, 7u171, 8u162, 10 and JRockit: R28.3.17. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Java SE, JRockit executes to compromise Java SE, JRockit. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, JRockit, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, JRockit. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 7.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).

Add Assessment

No one has assessed this topic. Be the first to add your voice to the community.

CVSS V3 Severity and Metrics

Data provided by the National Vulnerability Database (NVD)

Base Score:

7.7 High

Impact Score:

6

Exploitability Score:

1

Vector:

CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector (AV):

Local

Attack Complexity (AC):

High

Privileges Required (PR):

None

User Interaction (UI):

Required

Scope (S):

Changed

Confidentiality (C):

High

Integrity (I):

High

Availability (A):

High

Vendors

canonical,
debian,
hp,
oracle,
redhat,
schneider-electric

Products

debian linux 8.0,
debian linux 9.0,
enterprise linux desktop 6.0,
enterprise linux desktop 7.0,
enterprise linux server 6.0,
enterprise linux server 7.0,
enterprise linux server aus 7.6,
enterprise linux server eus 7.5,
enterprise linux server eus 7.6,
enterprise linux server tus 7.6,
enterprise linux workstation 6.0,
enterprise linux workstation 7.0,
jdk 1.6.0,
jdk 1.7.0,
jdk 1.8.0,
jdk 10,
jre 1.6.0,
jre 1.7.0,
jre 1.8.0,
jre 10,
jrockit r28.3.17,
satellite 5.6,
satellite 5.7,
satellite 5.8,
struxureware data center expert,
ubuntu linux 14.04,
ubuntu linux 16.04,
ubuntu linux 17.10,
xp7 command view

References

Canonical

CVE-2018-2794 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2794)

BID-103817 (http://www.securityfocus.com/bid/103817)

Advisory

https://access.redhat.com/errata/RHSA-2018:1278

DSA-4185 (https://www.debian.org/security/2018/dsa-4185)

https://access.redhat.com/errata/RHSA-2018:1975

https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03857en_us

GLSA-201903-14 (https://security.gentoo.org/glsa/201903-14)

DSA-4225 (https://www.debian.org/security/2018/dsa-4225)

SECTRACK-1040697 (http://www.securitytracker.com/id/1040697)

https://access.redhat.com/errata/RHSA-2018:1724

https://access.redhat.com/errata/RHSA-2018:1203

USN-3644-1 (https://usn.ubuntu.com/3644-1)

https://access.redhat.com/errata/RHSA-2018:1723

https://security.netapp.com/advisory/ntap-20180419-0001

https://access.redhat.com/errata/RHSA-2018:1201

https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0

https://access.redhat.com/errata/RHSA-2018:1204

http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html

https://access.redhat.com/errata/RHSA-2018:1722

https://access.redhat.com/errata/RHSA-2018:1974

https://access.redhat.com/errata/RHSA-2018:1205

https://access.redhat.com/errata/RHSA-2018:1721

USN-3691-1 (https://usn.ubuntu.com/3691-1)

https://access.redhat.com/errata/RHSA-2018:1202

https://access.redhat.com/errata/RHSA-2018:1191

https://access.redhat.com/errata/RHSA-2018:1188

https://access.redhat.com/errata/RHSA-2018:1206

https://access.redhat.com/errata/RHSA-2018:1270

https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03915en_us

Rapid7

Technical Analysis