CVE-2018-8088
critical · 9.8org.slf4j.ext.EventData in the slf4j-ext module in QOS.CH SLF4J before 1.8.0-beta2 allows remote attackers to bypass intended access restrictions via crafted data. EventData in the slf4j-ext module in QOS.CH SLF4J, has been fixed in SLF4J versions 1.7.26 later and in the 2.0.x series.
9.8
CVSS
14.7%
EPSS (exploit prob.)
97th
EPSS percentile
2018-03-20
Published
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| qos | slf4j | < 1.7.26 |
| qos | slf4j | 1.8.0 |
| qos | slf4j | 1.8.0 |
| qos | slf4j | 1.8.0 |
| qos | slf4j | 1.8.0 |
| redhat | jboss_enterprise_application_platform | 7.1 |
| redhat | enterprise_linux | 6.0 |
| redhat | enterprise_linux | 7.0 |
| redhat | jboss_enterprise_application_platform | 6.0.0 |
| redhat | jboss_enterprise_application_platform | 6.4.0 |
| redhat | enterprise_linux | 5.0 |
| redhat | enterprise_linux | 6.0 |
| redhat | enterprise_linux | 7.0 |
| redhat | virtualization | 4.0 |
| redhat | virtualization_host | 4.0 |
| redhat | enterprise_linux_server | 7.0 |
| redhat | enterprise_linux_desktop | 7.0 |
| redhat | enterprise_linux_eus | 7.4 |
| redhat | enterprise_linux_eus | 7.5 |
| redhat | enterprise_linux_eus | 7.6 |
| redhat | enterprise_linux_eus | 7.7 |
| redhat | enterprise_linux_server | 7.0 |
| redhat | enterprise_linux_server_aus | 7.4 |
| redhat | enterprise_linux_server_aus | 7.6 |
| redhat | enterprise_linux_server_aus | 7.7 |
| redhat | enterprise_linux_server_tus | 7.4 |
| redhat | enterprise_linux_server_tus | 7.6 |
| redhat | enterprise_linux_server_tus | 7.7 |
| redhat | enterprise_linux_workstation | 7.0 |
| oracle | goldengate_application_adapters | 12.3.2.1.0 |
| oracle | goldengate_stream_analytics | < 19.1.0.0.1 |
| oracle | utilities_framework | 4.2.0.2.0 |
| oracle | utilities_framework | 4.2.0.3.0 |
| oracle | utilities_framework | 4.3.0.2.0 |
| oracle | utilities_framework | 4.3.0.3.0 |
| oracle | utilities_framework | 4.3.0.4.0 |
| oracle | utilities_framework | 4.3.0.5.0 |
| oracle | utilities_framework | 4.3.0.6.0 |
| oracle | utilities_framework | 4.4.0.0.0 |
Check a specific version with /api/v1/cve/match.
References
- http://www.securityfocus.com/bid/103737
- http://www.securitytracker.com/id/1040627
- https://access.redhat.com/errata/RHSA-2018:0582
- https://access.redhat.com/errata/RHSA-2018:0592
- https://access.redhat.com/errata/RHSA-2018:0627
- https://access.redhat.com/errata/RHSA-2018:0628
- https://access.redhat.com/errata/RHSA-2018:0629
- https://access.redhat.com/errata/RHSA-2018:0630
- https://access.redhat.com/errata/RHSA-2018:1247
- https://access.redhat.com/errata/RHSA-2018:1248
- https://access.redhat.com/errata/RHSA-2018:1249
- https://access.redhat.com/errata/RHSA-2018:1251
- https://access.redhat.com/errata/RHSA-2018:1323
- https://access.redhat.com/errata/RHSA-2018:1447
- https://access.redhat.com/errata/RHSA-2018:1448
- https://access.redhat.com/errata/RHSA-2018:1449
- https://access.redhat.com/errata/RHSA-2018:1450
- https://access.redhat.com/errata/RHSA-2018:1451
- https://access.redhat.com/errata/RHSA-2018:1525
- https://access.redhat.com/errata/RHSA-2018:1575
- https://access.redhat.com/errata/RHSA-2018:2143
- https://access.redhat.com/errata/RHSA-2018:2419
- https://access.redhat.com/errata/RHSA-2018:2420
- https://access.redhat.com/errata/RHSA-2018:2669
- https://access.redhat.com/errata/RHSA-2018:2930
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2018-8088