Lucene search

OracleCVE-2017-10282

HistoryJan 18, 2018 - 2:29 a.m.

CVE-2017-10282

2018-01-1802:29:16

oracle

web.nvd.nist.gov

cve-2017-10282

oracle database

rdbms

core rdbms

vulnerability

12.1.0.2

12.2.0.1

cvss 3.0

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

AI Score

8.3

Confidence

High

EPSS

0.001

Percentile

49.9%

JSON

Vulnerability in the Core RDBMS component of Oracle Database Server. Supported versions that are affected are 12.1.0.2 and 12.2.0.1. Easily exploitable vulnerability allows high privileged attacker having Create Session, Execute Catalog Role privilege with network access via Oracle Net to compromise Core RDBMS. While the vulnerability is in Core RDBMS, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Core RDBMS. CVSS 3.0 Base Score 9.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).

Affected configurations

Nvd

Vulners

Node

oracledatabase_serverMatch12.1.0.2

oracledatabase_serverMatch12.2.0.1

VendorProductVersionCPE
oracledatabase_server12.1.0.2cpe:2.3:a:oracle:database_server:12.1.0.2:*:*:*:*:*:*:*
oracledatabase_server12.2.0.1cpe:2.3:a:oracle:database_server:12.2.0.1:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
oracle	database_server	12.1.0.2	cpe:2.3:a:oracle:database_server:12.1.0.2:::::::*
oracle	database_server	12.2.0.1	cpe:2.3:a:oracle:database_server:12.2.0.1:::::::*

CNA Affected

[
  {
    "product": "Oracle Database",
    "vendor": "Oracle Corporation",
    "versions": [
      {
        "status": "affected",
        "version": "12.1.0.2"
      },
      {
        "status": "affected",
        "version": "12.2.0.1"
      }
    ]
  }
]

References

www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html

www.securityfocus.com/bid/102534

www.securitytracker.com/id/1040196

Social References

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

AI Score

8.3

Confidence

High

EPSS

0.001

Percentile

49.9%

JSON

Related for CVE-2017-10282