CVE-2018-2561: Medium severity oracle http server vulnerability

Published Jan 18, 2018

Updated

Vulnerability in the Oracle HTTP Server component of Oracle Fusion Middleware (subcomponent: Web Listener). Supported versions that are affected are 11.1.1.7.0, 11.1.1.9.0, 12.1.3.0.0, 12.2.1.2.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle HTTP Server. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

Affected Software

5 affected components

Oracle HTTP Server=11.1.1.7.0

Oracle HTTP Server=11.1.1.9.0

Oracle HTTP Server=12.1.3.0.0

Oracle HTTP Server=12.2.1.2.0

Oracle HTTP Server=12.2.1.3.0

Remediation

Patch Available

http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html

Event History

Jan 18, 2018

CVE Published

via MITRE·02:00 AM

Data Sourced

via MITRE·02:00 AM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2018-2561?

CVE-2018-2561 has a severity rating that indicates it is easily exploitable by unauthenticated attackers.

How do I fix CVE-2018-2561?

To fix CVE-2018-2561, upgrade your Oracle HTTP Server to a patched version that addresses the vulnerability.

What versions of Oracle HTTP Server are affected by CVE-2018-2561?

CVE-2018-2561 affects versions 11.1.1.7.0, 11.1.1.9.0, 12.1.3.0.0, 12.2.1.2.0, and 12.2.1.3.0.

Can CVE-2018-2561 be exploited remotely?

Yes, CVE-2018-2561 can be exploited remotely by an attacker with network access.

What are the potential impacts of CVE-2018-2561?

The potential impacts of CVE-2018-2561 include unauthorized access and control over the affected Oracle HTTP Server instances.