Lucene search

OracleCVE-2017-10323

HistoryOct 19, 2017 - 5:29 p.m.

CVE-2017-10323

2017-10-1917:29:03

oracle

web.nvd.nist.gov

oracle

e-business suite

cve-2017-10323

vulnerability

web applications

desktop integrator

security

http

cvss

CVSS2

5.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

CVSS3

8.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

AI Score

8.1

Confidence

High

EPSS

0.001

Percentile

50.1%

JSON

Vulnerability in the Oracle Web Applications Desktop Integrator component of Oracle E-Business Suite (subcomponent: Application Service). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Web Applications Desktop Integrator, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Web Applications Desktop Integrator accessible data as well as unauthorized update, insert or delete access to some of Oracle Web Applications Desktop Integrator accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N).

Affected configurations

Nvd

Vulners

Node

oracleweb_applications_desktop_integratorMatch12.1.1

oracleweb_applications_desktop_integratorMatch12.1.2

oracleweb_applications_desktop_integratorMatch12.1.3

oracleweb_applications_desktop_integratorMatch12.2.3

oracleweb_applications_desktop_integratorMatch12.2.4

oracleweb_applications_desktop_integratorMatch12.2.5

oracleweb_applications_desktop_integratorMatch12.2.6

VendorProductVersionCPE
oracleweb_applications_desktop_integrator12.1.1cpe:2.3:a:oracle:web_applications_desktop_integrator:12.1.1:*:*:*:*:*:*:*
oracleweb_applications_desktop_integrator12.1.2cpe:2.3:a:oracle:web_applications_desktop_integrator:12.1.2:*:*:*:*:*:*:*
oracleweb_applications_desktop_integrator12.1.3cpe:2.3:a:oracle:web_applications_desktop_integrator:12.1.3:*:*:*:*:*:*:*
oracleweb_applications_desktop_integrator12.2.3cpe:2.3:a:oracle:web_applications_desktop_integrator:12.2.3:*:*:*:*:*:*:*
oracleweb_applications_desktop_integrator12.2.4cpe:2.3:a:oracle:web_applications_desktop_integrator:12.2.4:*:*:*:*:*:*:*
oracleweb_applications_desktop_integrator12.2.5cpe:2.3:a:oracle:web_applications_desktop_integrator:12.2.5:*:*:*:*:*:*:*
oracleweb_applications_desktop_integrator12.2.6cpe:2.3:a:oracle:web_applications_desktop_integrator:12.2.6:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
oracle	web_applications_desktop_integrator	12.1.1	cpe:2.3:a:oracle:web_applications_desktop_integrator:12.1.1:::::::*
oracle	web_applications_desktop_integrator	12.1.2	cpe:2.3:a:oracle:web_applications_desktop_integrator:12.1.2:::::::*
oracle	web_applications_desktop_integrator	12.1.3	cpe:2.3:a:oracle:web_applications_desktop_integrator:12.1.3:::::::*
oracle	web_applications_desktop_integrator	12.2.3	cpe:2.3:a:oracle:web_applications_desktop_integrator:12.2.3:::::::*
oracle	web_applications_desktop_integrator	12.2.4	cpe:2.3:a:oracle:web_applications_desktop_integrator:12.2.4:::::::*
oracle	web_applications_desktop_integrator	12.2.5	cpe:2.3:a:oracle:web_applications_desktop_integrator:12.2.5:::::::*
oracle	web_applications_desktop_integrator	12.2.6	cpe:2.3:a:oracle:web_applications_desktop_integrator:12.2.6:::::::*

CNA Affected

[
  {
    "product": "Web Applications Desktop Integrator",
    "vendor": "Oracle Corporation",
    "versions": [
      {
        "status": "affected",
        "version": "12.1.1"
      },
      {
        "status": "affected",
        "version": "12.1.2"
      },
      {
        "status": "affected",
        "version": "12.1.3"
      },
      {
        "status": "affected",
        "version": "12.2.3"
      },
      {
        "status": "affected",
        "version": "12.2.4"
      },
      {
        "status": "affected",
        "version": "12.2.5"
      },
      {
        "status": "affected",
        "version": "12.2.6"
      }
    ]
  }
]

References

www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

www.securityfocus.com/bid/101367

www.securitytracker.com/id/1039592

CVSS2

5.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

CVSS3

8.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

AI Score

8.1

Confidence

High

EPSS

0.001

Percentile

50.1%

JSON

Related for CVE-2017-10323