CVE-2018-2879

🗓️ 19 Apr 2018 02:00:00Reported by oracleType

cve🔗 web.nvd.nist.gov👁 100 Views🌐 WEB

Vulnerability in Oracle Access Manager component of Oracle Fusion Middleware, allowing unauthenticated attacker to compromise the system. See Oracle Support Note 2386496.1

Reporter	Title	Published	Views	Family All 19
zdt	Oracle Access Manager 11.1.2.3.0 / 12.2.1.3.0 Authentication Bypass Vulnerability	4 May 201800:00	–	zdt
GithubExploit	Exploit for CVE-2018-2879	26 Jul 201819:31	–	githubexploit
GithubExploit	Exploit for CVE-2018-2879	29 Jul 201818:56	–	githubexploit
GithubExploit	Exploit for CVE-2018-2879	14 Apr 201916:32	–	githubexploit
Circl	CVE-2018-2879	4 May 201810:03	–	circl
CNVD	Oracle Access Manager Remote Vulnerability (CNVD-2018-09095)	23 Apr 201800:00	–	cnvd
Cvelist	CVE-2018-2879	19 Apr 201802:00	–	cvelist
Hacker One	U.S. Dept Of Defense: [HTAF4-213] [Pre-submission] CVE-2018-2879 (padding oracle attack in the Oracle Access Manager) at https://█████████	3 Nov 201904:23	–	hackerone
Kitploit	oracle-oam-authentication-bypas-exploit	30 Oct 202617:20	–	kitploit
Kitploit	Oracle-OAM-Padding-Oracle-CVE-2018-2879-Exploit	30 Oct 202610:10	–	kitploit

NVD

Vulners

Node

oracle access_managerMatch11.1.2.3.0

oracle access_managerMatch12.2.1.3.0

[
  {
    "product": "Access Manager",
    "vendor": "Oracle Corporation",
    "versions": [
      {
        "status": "affected",
        "version": "11.1.2.3.0"
      },
      {
        "status": "affected",
        "version": "12.2.1.3.0"
      }
    ]
  }
]

Source	Link
securitytracker	www.securitytracker.com/id/1040695
seclists	www.seclists.org/bugtraq/2019/Apr/27
sec-consult	www.sec-consult.com/en/blog/2018/05/oracle-access-managers-identity-crisis/
github	www.github.com/MostafaSoliman/Oracle-OAM-Padding-Oracle-CVE-2018-2879-Exploit
seclists	www.seclists.org/fulldisclosure/2019/Apr/28
securityfocus	www.securityfocus.com/bid/103788
oracle	www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
packetstormsecurity	www.packetstormsecurity.com/files/152551/OAMbuster-Multi-Threaded-CVE-2018-2879-Scanner.html

Parameter	Position	Path	Description	CWE
encquery	query param	any	Oracle Access Manager (OAM) is vulnerable to a padding oracle attack due to improper usage of CBC encryption mode. An attacker can manipulate the 'encquery' parameter to decrypt and eventually forge authentication cookies.	CWE-353
OAMAuthnCookie	header	any	The OAMAuthnCookie cookie is used for authentication. Due to the padding oracle vulnerability, an attacker can forge this cookie to bypass authentication and impersonate any user, including administrators.	CWE-353

17 Jun 2026 01:56Current

7.8High risk

Vulners AI Score7.8

CVSS 26.8

CVSS 39

EPSS0.21362

SSVC