CVE-2018-8013 in Rapid Planninginfo

Summary

In Apache Batik 1.x before 1.10, when deserializing subclass of `AbstractDocument`, the class takes a string from the inputStream as the class name which then use it to call the no-arg constructor of the class. Fix was to check the class type before calling newInstance in deserialization.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Reservation

03/09/2018

Status

Confirmed

Entries

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerability	CWE	Exp	Cou	CVE
158478	Oracle Rapid Planning Middle Tier deserialization	502	Not defined	Official fix	CVE-2018-8013
138018	Oracle WebCenter Sites Oracle WebLogic Server deserialization	502	Not defined	Official fix	CVE-2018-8013
137893	Oracle Application Session Controller OpenSSL deserialization	502	Not defined	Official fix	CVE-2018-8013
133614	Oracle Data Integrator Apache Batik deserialization	502	Not defined	Official fix	CVE-2018-8013
129679	Oracle Retail Integration Bus RIB Kernel deserialization	502	Not defined	Official fix	CVE-2018-8013
129619	Oracle JD Edwards EnterpriseOne Tools Web Runtime SEC deserialization	502	Not defined	Official fix	CVE-2018-8013
129611	Oracle Insurance Policy Administration J2EE User deserialization	502	Not defined	Official fix	CVE-2018-8013
129480	Oracle Communications WebRTC Session Controller Apache Batik deserialization	502	Not defined	Official fix	CVE-2018-8013
129479	Oracle Communications Diameter Signaling Router Apache Batik deserialization	502	Not defined	Official fix	CVE-2018-8013
125617	Oracle Retail Returns Management Apache Batik deserialization	502	Not defined	Official fix	CVE-2018-8013
125616	Oracle Retail Point-of-Service Apache Batik deserialization	502	Not defined	Official fix	CVE-2018-8013
125615	Oracle Retail Order Broker Upgrade Install deserialization	502	Not defined	Official fix	CVE-2018-8013
125614	Oracle Retail Central Office Apache Batik deserialization	502	Not defined	Official fix	CVE-2018-8013
125613	Oracle Retail Back Office Apache Batik deserialization	502	Not defined	Official fix	CVE-2018-8013
125512	Oracle Insurance Calculation Engine Architecture deserialization	502	Not defined	Official fix	CVE-2018-8013
125448	Oracle Enterprise Repository Security deserialization	502	Not defined	Official fix	CVE-2018-8013
125447	Oracle Business Intelligence Enterprise Edition Apache Batik deserialization	502	Not defined	Official fix	CVE-2018-8013
125390	Oracle Construction/Engineering Suite Instantis EnterpriseTrack deserialization	502	Not defined	Official fix	CVE-2018-8013
125381	Oracle Communications MetaSolv Solution Print Preview deserialization	502	Not defined	Official fix	CVE-2018-8013
121697	Oracle Fusion Middleware MapViewer Install deserialization	502	Not defined	Official fix	CVE-2018-8013
121639	Oracle Financial Services Analytical Applications Infrastructure Link Analysis/Metadata Browser deserialization	502	Not defined	Official fix	CVE-2018-8013
118200	Apache Batik deserialization	502	Not defined	Official fix	CVE-2018-8013

Description

CPE

CWE

CVSS

Exploits

History

Diff

Relate

Threat Intelligence

API JSON

API XML

API CSV

Sources

◂ PreviousOverviewNext ▸

Do you need the next level of professionalism?

Upgrade your account now!