Lucene search

OracleCVE-2017-10026

HistoryOct 19, 2017 - 5:29 p.m.

CVE-2017-10026

2017-10-1917:29:00

oracle

web.nvd.nist.gov

oracle

soa suite

oracle fusion middleware

vulnerability

cve-2017-10026

security advisory

network security

confidentiality

integrity

cvss score

CVSS2

5.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

CVSS3

8.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

AI Score

8.2

Confidence

High

EPSS

0.001

Percentile

50.1%

JSON

Vulnerability in the Oracle SOA Suite component of Oracle Fusion Middleware (subcomponent: Fabric Layer). The supported version that is affected is 11.1.1.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle SOA Suite accessible data as well as unauthorized update, insert or delete access to some of Oracle SOA Suite accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N).

Affected configurations

Nvd

Vulners

Node

oraclesoa_suiteMatch11.1.1.7.0

VendorProductVersionCPE
oraclesoa_suite11.1.1.7.0cpe:2.3:a:oracle:soa_suite:11.1.1.7.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
oracle	soa_suite	11.1.1.7.0	cpe:2.3:a:oracle:soa_suite:11.1.1.7.0:::::::*

CNA Affected

[
  {
    "product": "SOA Suite",
    "vendor": "Oracle Corporation",
    "versions": [
      {
        "status": "affected",
        "version": "11.1.1.7.0"
      }
    ]
  }
]

References

www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

www.securityfocus.com/bid/101318

www.securitytracker.com/id/1039602

CVSS2

5.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

CVSS3

8.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

AI Score

8.2

Confidence

High

EPSS

0.001

Percentile

50.1%

JSON

Related for CVE-2017-10026