CVE-2017-10202

Vulnerability in the OJVM component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2 and 12.2.0.1. Easily exploitable vulnerability allows low privileged attacker having Create Session, Create Procedure privilege with network access via multiple protocols to compromise OJVM. While the vulnerability is in OJVM, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of OJVM. Note: This score is for Windows platforms. On non-Windows platforms Scope is Unchanged, giving a CVSS Base Score of 8.8. CVSS 3.0 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

CVSS v3 9.9 CRITICAL
CVSS v2.0 6.5 MEDIUM

9.9^/10

CVSS v3 : CRITICAL

Vector : AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Exploitability : 3.1 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

6.5^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 8.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html	Patch Vendor Advisory
http://www.securityfocus.com/bid/99865	Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1038923	Third Party Advisory VDB Entry

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:oracle:database:11.2.0.4:::::::*
	cpe:2.3:a:oracle:database:12.1.0.2:::::::*
	cpe:2.3:a:oracle:database:12.2.0.1:::::::*

History

No history.

Information

Published : 2017-08-08 15:29

Updated : 2023-12-10 12:15

NVD link : CVE-2017-10202

Mitre link : CVE-2017-10202

CVE.ORG link : CVE-2017-10202

JSON object : View

Products Affected

oracle

database

CWE

NVD-CWE-noinfo

{"id": "CVE-2017-10202", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 9.9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.1}]}, "published": "2017-08-08T15:29:05.960", "references": [{"url": "http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html", "tags": ["Patch", "Vendor Advisory"], "source": "secalert_us@oracle.com"}, {"url": "http://www.securityfocus.com/bid/99865", "tags": ["Third Party Advisory", "VDB Entry"], "source": "secalert_us@oracle.com"}, {"url": "http://www.securitytracker.com/id/1038923", "tags": ["Third Party Advisory", "VDB Entry"], "source": "secalert_us@oracle.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "Vulnerability in the OJVM component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2 and 12.2.0.1. Easily exploitable vulnerability allows low privileged attacker having Create Session, Create Procedure privilege with network access via multiple protocols to compromise OJVM. While the vulnerability is in OJVM, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of OJVM. Note: This score is for Windows platforms. On non-Windows platforms Scope is Unchanged, giving a CVSS Base Score of 8.8. CVSS 3.0 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)."}, {"lang": "es", "value": "Vulnerabilidad en el componente OJVM de Oracle Database Server. Las versiones compatibles que se han visto afectadas son la 11.2.0.4, 12.1.0.2 y la 12.2.0.1. Una vulnerabilidad f\u00e1cilmente explotable permite que un atacante con un bajo nivel de privilegios y con permisos Create Session y Create Procedure que tenga acceso a red por medio de m\u00faltiples protocolos comprometa la seguridad de OJVM. Aunque la vulnerabilidad est\u00e1 presente en OJVM, los ataques podr\u00edan afectar seriamente a productos adicionales. Los ataques exitosos a esta vulnerabilidad pueden resultar en la toma de control de OJVM. Nota: Esta puntuaci\u00f3n es para plataformas Windows. En plataformas distintas a Windows, el alcance no cambia, por lo que se da una puntuaci\u00f3n base de CVSS de 8.8. CVSS 3.0 Base Score 9.9 (mpactos en la confidencialidad, integridad y disponibilidad). Vector CVSS: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)."}], "lastModified": "2019-10-03T00:03:26.223", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:oracle:database:11.2.0.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5100F5C8-D5F8-466B-AABE-E42B3770B39D"}, {"criteria": "cpe:2.3:a:oracle:database:12.1.0.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1F3C58EE-B36B-4081-A307-0FE9B52D8E62"}, {"criteria": "cpe:2.3:a:oracle:database:12.2.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E221FD4B-190F-4752-9617-FB0C704E7AFD"}], "operator": "OR"}]}], "sourceIdentifier": "secalert_us@oracle.com"}