Lucene search

OracleCVE-2017-10031

HistoryAug 08, 2017 - 3:29 p.m.

CVE-2017-10031

2017-08-0815:29:01

oracle

web.nvd.nist.gov

cve-2017-10031

oracle

communications

convergence

vulnerability

http

cvss 3.0

security

nvd

CVSS2

6.4

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:P/A:N

CVSS3

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

AI Score

6.4

Confidence

High

EPSS

0.002

Percentile

53.2%

JSON

Vulnerability in the Oracle Communications Convergence component of Oracle Communications Applications (subcomponent: Mail Proxy (dojo)). Supported versions that are affected are 3.0 and 3.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Convergence. While the vulnerability is in Oracle Communications Convergence, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Communications Convergence accessible data as well as unauthorized read access to a subset of Oracle Communications Convergence accessible data. CVSS 3.0 Base Score 7.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N).

Affected configurations

Nvd

Vulners

Node

oraclecommunications_convergenceMatch3.0

oraclecommunications_convergenceMatch3.0.1

VendorProductVersionCPE
oraclecommunications_convergence3.0cpe:2.3:a:oracle:communications_convergence:3.0:*:*:*:*:*:*:*
oraclecommunications_convergence3.0.1cpe:2.3:a:oracle:communications_convergence:3.0.1:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
oracle	communications_convergence	3.0	cpe:2.3:a:oracle:communications_convergence:3.0:::::::*
oracle	communications_convergence	3.0.1	cpe:2.3:a:oracle:communications_convergence:3.0.1:::::::*

CNA Affected

[
  {
    "product": "Communications Convergence",
    "vendor": "Oracle Corporation",
    "versions": [
      {
        "status": "affected",
        "version": "3.0"
      },
      {
        "status": "affected",
        "version": "3.0.1"
      }
    ]
  }
]

References

www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html

www.securityfocus.com/bid/99720

www.securitytracker.com/id/1038945

CVSS2

6.4

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:P/A:N

CVSS3

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

AI Score

6.4

Confidence

High

EPSS

0.002

Percentile

53.2%

JSON

Related for CVE-2017-10031