4
CVSSv2

CVE-2018-2800

Published: 19/04/2018 Updated: 13/05/2022
CVSS v2 Base Score: 4 | Impact Score: 4.9 | Exploitability Score: 4.9
CVSS v3 Base Score: 4.2 | Impact Score: 2.5 | Exploitability Score: 1.6
VMScore: 356
Vector: AV:N/AC:H/Au:N/C:P/I:P/A:N

Vulnerability Summary

Vulnerability in the Java SE, JRockit component of Oracle Java SE (subcomponent: RMI). Supported versions that are affected are Java SE: 6u181, 7u171 and 8u162; JRockit: R28.3.17. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, JRockit. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, JRockit accessible data as well as unauthorized read access to a subset of Java SE, JRockit accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.0 Base Score 4.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N).

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

oracle jdk 1.8.0

oracle jdk 1.7.0

oracle jdk 1.6.0

oracle jre 1.6.0

oracle jre 1.8.0

oracle jre 1.7.0

oracle jrockit r28.3.17

redhat enterprise linux desktop 7.0

redhat enterprise linux workstation 7.0

redhat satellite 5.7

redhat enterprise linux server 7.0

redhat enterprise linux desktop 6.0

redhat enterprise linux server 6.0

redhat enterprise linux workstation 6.0

redhat enterprise linux server eus 7.5

redhat satellite 5.6

redhat satellite 5.8

redhat enterprise linux server tus 7.6

redhat enterprise linux server aus 7.6

redhat enterprise linux server eus 7.6

debian debian linux 8.0

debian debian linux 9.0

canonical ubuntu linux 16.04

canonical ubuntu linux 14.04

canonical ubuntu linux 17.10

schneider-electric struxureware data center expert

hp xp7 command view

Vendor Advisories

Several security issues were fixed in OpenJDK 7 ...
Several security issues were fixed in OpenJDK 8 ...
Several vulnerabilities have been discovered in OpenJDK, an implementation of the Oracle Java platform, resulting in denial of service, sandbox bypass, execution of arbitrary code or bypass of JAR signature validation For the stable distribution (stretch), these problems have been fixed in version 8u171-b11-1~deb9u1 We recommend that you upgrade ...
Several vulnerabilities have been discovered in OpenJDK, an implementation of the Oracle Java platform, resulting in denial of service, sandbox bypass, execution of arbitrary code or bypass of JAR signature validation For the oldstable distribution (jessie), these problems have been fixed in version 7u181-2614-1~deb8u1 We recommend that you upg ...
Unbounded memory allocation during deserialization in Container (AWT, 8189989)Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: AWT) Supported versions that are affected are Java SE: 6u181, 7u171, 8u162 and 10; Java SE Embedded: 8u161; JRockit: R28317 Easily exploitable vulnerability allows unaut ...
Unbounded memory allocation during deserialization in NamedNodeMapImpl (JAXP, 8189993)Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JAXP) Supported versions that are affected are Java SE: 7u171, 8u162 and 10; Java SE Embedded: 8u161; JRockit: R28317 Easily exploitable vulnerability allows una ...
Synopsis Important: java-170-openjdk security update Type/Severity Security Advisory: Important Topic An update for java-170-openjdk is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring Sys ...
Synopsis Important: java-160-sun security update Type/Severity Security Advisory: Important Topic An update for java-160-sun is now available for Oracle Java for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Sco ...
Synopsis Critical: java-170-oracle security update Type/Severity Security Advisory: Critical Topic An update for java-170-oracle is now available for Oracle Java for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Critical A Common Vulnerability ...
Synopsis Important: java-171-ibm security update Type/Severity Security Advisory: Important Topic An update for java-171-ibm is now available for Red Hat Enterprise Linux 7 SupplementaryRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scori ...
Synopsis Important: java-180-ibm security update Type/Severity Security Advisory: Important Topic An update for java-180-ibm is now available for Red Hat Enterprise Linux 7 SupplementaryRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scori ...
Synopsis Critical: java-180-openjdk security update Type/Severity Security Advisory: Critical Topic An update for java-180-openjdk is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Critical A Common Vulnerability Scoring System ...
Synopsis Critical: java-170-oracle security update Type/Severity Security Advisory: Critical Topic An update for java-170-oracle is now available for Oracle Java for Red Hat Enterprise Linux 6Red Hat Product Security has rated this update as having a security impact of Critical A Common Vulnerability ...
Synopsis Critical: java-180-oracle security update Type/Severity Security Advisory: Critical Topic An update for java-180-oracle is now available for Oracle Java for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Critical A Common Vulnerability ...
Synopsis Critical: java-180-oracle security update Type/Severity Security Advisory: Critical Topic An update for java-180-oracle is now available for Oracle Java for Red Hat Enterprise Linux 6Red Hat Product Security has rated this update as having a security impact of Critical A Common Vulnerability ...
Synopsis Important: java-160-sun security update Type/Severity Security Advisory: Important Topic An update for java-160-sun is now available for Oracle Java for Red Hat Enterprise Linux 6Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Sco ...
Synopsis Important: java-171-ibm security update Type/Severity Security Advisory: Important Topic An update for java-171-ibm is now available for Red Hat Enterprise Linux 6 SupplementaryRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scori ...
Synopsis Important: java-170-openjdk security update Type/Severity Security Advisory: Important Topic An update for java-170-openjdk is now available for Red Hat Enterprise Linux 6Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring Sys ...
Synopsis Moderate: java-171-ibm security update Type/Severity Security Advisory: Moderate Topic An update for java-171-ibm is now available for Red Hat Satellite 56 and Red Hat Satellite 57Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability S ...
Synopsis Important: java-180-ibm security update Type/Severity Security Advisory: Important Topic An update for java-180-ibm is now available for Red Hat Enterprise Linux 6 SupplementaryRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scori ...
Synopsis Moderate: java-180-ibm security update Type/Severity Security Advisory: Moderate Topic An update for java-180-ibm is now available for Red Hat Satellite 58Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS) base ...
Synopsis Critical: java-180-openjdk security update Type/Severity Security Advisory: Critical Topic An update for java-180-openjdk is now available for Red Hat Enterprise Linux 6Red Hat Product Security has rated this update as having a security impact of Critical A Common Vulnerability Scoring System ...
Unbounded memory allocation during deserialization in Container (AWT, 8189989)Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: AWT) Supported versions that are affected are Java SE: 6u181, 7u171, 8u162 and 10; Java SE Embedded: 8u161; JRockit: R28317 Easily exploitable vulnerability allows unaut ...
Unbounded memory allocation during deserialization in NamedNodeMapImpl (JAXP, 8189993)Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JAXP) Supported versions that are affected are Java SE: 7u171, 8u162 and 10; Java SE Embedded: 8u161; JRockit: R28317 Easily exploitable vulnerability allows una ...
Vulnerability in the Java SE, JRockit component of Oracle Java SE (subcomponent: RMI) Supported versions that are affected are Java SE: 6u181, 7u171 and 8u162; JRockit: R28317 Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, JRockit Successful attacks require h ...

Github Repositories

A Java serializer in JavaScript

A Java serializer in JavaScript Implementation of native Java serialization in JavaScript Also includes two deserialization payload generators (as seen on ysoserial: JRMPClient and a JNDI variant of CommonBeanutils1) as well as a PoC for CVE-2018-2800: Up to the April 2018 CPU (6u191, 7u181, 8u171) Java's RMI endpoints allowed HTTP tunneling of requests Failing to implem

References

NVD-CWE-noinfohttp://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.htmlhttp://www.securitytracker.com/id/1040697http://www.securityfocus.com/bid/103849https://security.netapp.com/advisory/ntap-20180419-0001/https://access.redhat.com/errata/RHSA-2018:1191https://access.redhat.com/errata/RHSA-2018:1188https://access.redhat.com/errata/RHSA-2018:1206https://access.redhat.com/errata/RHSA-2018:1205https://access.redhat.com/errata/RHSA-2018:1204https://access.redhat.com/errata/RHSA-2018:1203https://access.redhat.com/errata/RHSA-2018:1202https://access.redhat.com/errata/RHSA-2018:1201https://www.debian.org/security/2018/dsa-4185https://access.redhat.com/errata/RHSA-2018:1270https://access.redhat.com/errata/RHSA-2018:1278https://usn.ubuntu.com/3644-1/https://access.redhat.com/errata/RHSA-2018:1724https://access.redhat.com/errata/RHSA-2018:1723https://access.redhat.com/errata/RHSA-2018:1722https://access.redhat.com/errata/RHSA-2018:1721https://www.debian.org/security/2018/dsa-4225https://usn.ubuntu.com/3691-1/https://access.redhat.com/errata/RHSA-2018:1975https://access.redhat.com/errata/RHSA-2018:1974https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03857en_ushttps://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0https://security.gentoo.org/glsa/201903-14https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03915en_ushttps://nvd.nist.govhttps://usn.ubuntu.com/3691-1/