oracle-oam-authentication-bypas-exploit

Oracle Access Manager OAM Authentication Bypass Exploit Introduction Exploiting Oracle Access Manager OAM padding oracle vulnerability CVE-2018-2879 to perform authentication bypass and login to any web app protected by OAM using valid username. This exploit is based on OAM padding oracle...

Oracle-OAM-Padding-Oracle-CVE-2018-2879-Exploit

Oracle-OAM-Padding-Oracle-CVE-2018-2879-Exploit Introduction This exploit was developed during pentesting activity against oracle OAM 11.1.2.3.0. It was developed based on the technical description by sec-consult https://www.sec-consult.com/en/blog/2018/05/oracle-access-managers-identity-crisis/...

OAMBuster

OAMBuster Multithreaded Padding Oracle Attack on Oracle OAM CVE-2018-2879 Authors Red Timmy Marco Ortisi, Stefan Broeder, Ahmad Mahfouz Description This multithreaded exploit was developed to greatly increase the speed of the attack as compared to the single threaded version. For more information...

U.S. Dept Of Defense: [HTAF4-213] [Pre-submission] CVE-2018-2879 (padding oracle attack in the Oracle Access Manager) at https://█████████

Description We were able to identify CVE-2018-2879 in Oracle Access Manager, used on the https://██████ Link to the CVE: https://nvd.nist.gov/vuln/detail/CVE-2018-2879 This vulnerability is rated critical, and may allow unauthenticated attacker with network access via HTTP to compromise Oracle...

Oracle Access Manager Multiple Vulnerabilities (Apr 2018 CPU)

The version of Oracle Access Manager installed on the remote host is affected by multiple vulnerabilities. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid109733; scriptversion"1.8";...

CVE-2018-2879

The CVE-2018-2879 issue affects Oracle Access Manager (part of Oracle Fusion Middleware) specifically the Authentication Engine in versions 11.1.2.3.0 and 12.2.1.3.0. The root cause is a vulnerability that enables unauthenticated attackers with network access over HTTP to compromise Oracle Access...