CVE-2018-2675 Information disclosure in Java

What is CVE-2018-2675?

CVE-2018-2675 is a low-severity vulnerability in Oracle Corporation Java, published on 18 Jan 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Vulnerability in the Java Advanced Management Console component of Oracle Java SE (subcomponent: Server). The supported version that is affected is Java Advanced Management Console: 2.8. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java Advanced Management Console. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java Advanced Management Console accessible data. CVSS 3.0 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).

Which versions are affected by CVE-2018-2675?

It affects 1 product.

Products include Oracle Java Advanced Management Console.

How do I fix CVE-2018-2675?

No fix has been published for CVE-2018-2675 yet. Limit exposure of the affected software until one is available.

Is CVE-2018-2675 being exploited?

There is no known exploitation of CVE-2018-2675 in the wild and no public exploit code.

Other vulnerabilities in Oracle Corporation Java

• CVE-2017-10104 Privilege escalation in Java High 7.4
• CVE-2017-10145 Missing authorization in Java High 7.4
• CVE-2019-2540 Missing authorization in Java Medium 6.1
• CVE-2017-10121 Missing authorization in Java Medium 6.1
• CVE-2017-10342 Denial of service in Java Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-m4wm-fggc-g668.