CVE-2018-2952
3.7 · LOWVulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Concurrency).
Overview
CVE-2018-2952 is a low-severity vulnerability. It was published on July 18, 2018 and has a CVSS 3.1 base score of 3.7 (LOW).
This vulnerability has a CVSS 3.1 base score of 3.7, rated LOW. It can be exploited remotely over the network. No authentication or special privileges are required for exploitation.
Technical description
Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Concurrency). Supported versions that are affected are Java SE: 6u191, 7u181, 8u172 and 10.0.1; Java SE Embedded: 8u171; JRockit: R28.3.18. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/P
Remediation
Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.
References
How CyberStrike helps
Reason, not just scan
It reasons through your app's logic the way a human pentester would, so it finds flaws signature scanners miss.
Learn moreVerified findings
Every finding is proven exploitable before you see it, which cuts the false positives that bury real risk.
Learn moreAI-driven DAST and SAST
Probe running apps and read source from one engine, so issues are caught before and after they ship.
Learn moreOpen source
Read exactly how it tests and what it reports. CyberStrike is open source and in early access.
View the repo
Frequently asked questions
What is CVE-2018-2952?
CVE-2018-2952 is a low-severity vulnerability. It was published on July 18, 2018 and has a CVSS 3.1 base score of 3.7 (LOW).
How severe is CVE-2018-2952?
This vulnerability has a CVSS 3.1 base score of 3.7, rated LOW. It can be exploited remotely over the network. No authentication or special privileges are required for exploitation.
How do I fix or remediate CVE-2018-2952?
Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.
How can CyberStrike help with CVE-2018-2952?
CyberStrike is an open-source, AI-augmented pentesting engine. Rather than flag a version number, it tests whether an issue like CVE-2018-2952 is actually reachable in your own applications and APIs, then verifies each finding before reporting it. That tells you if the weakness is a real, exploitable risk in your environment or a false positive you can safely deprioritize.
Related LOW CVEs from 2018
View all- 3.9CVE-2017-17149
Huawei HiWallet App with the versions before 8.0.4 has an arbitrary lock pattern change vulnerabilit
View details - 3.9CVE-2018-7676
The NetIQ Identity Manager, in versions prior to 4.7, userapp with log / trace enabled may leak sens
View details - 3.9CVE-2017-9635
Schneider Electric Ampla MES 6.4 provides capability to configure users and their privileges. When A
View details - 3.9CVE-2018-1123
procps-ng before version 3.3.15 is vulnerable to a denial of service in ps via mmap buffer overflow.
View details - 3.9CVE-2018-1121
procps-ng, procps is vulnerable to a process hiding through race condition. Since the kernel's proc_
View details - 3.9CVE-2018-7947
Huawei mobile phones with versions earlier before Emily-AL00A 8.1.0.153(C00) have an authentication
View details - 3.9CVE-2018-3266
Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Verified
View details - 3.8CVE-2018-5730
MIT krb5 1.6 or later allows an authenticated kadmin with permission to add principals to an LDAP Ke
View details - 3.8CVE-2018-2412
SAP Disclosure Management 10.1 does not perform necessary authorization checks for an authenticated
View details - 3.8CVE-2018-2792
Vulnerability in the Hardware Management Pack component of Oracle Sun Systems Products Suite (subcom
View details - 3.8CVE-2018-2831
Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). S
View details - 3.8CVE-2018-10852
The UNIX pipe which sudo uses to contact SSSD and read the available sudo rules from SSSD has too wi
View details