CVE-2017-10000: High severity oracle hospitality reporting and analytics vulnerability

Published Aug 8, 2017

Updated

Vulnerability in the Oracle Hospitality Reporting and Analytics component of Oracle Hospitality Applications (subcomponent: Reporting). Supported versions that are affected are 8.5.1 and 9.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hospitality Reporting and Analytics. While the vulnerability is in Oracle Hospitality Reporting and Analytics, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Hospitality Reporting and Analytics. CVSS 3.0 Base Score 7.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H).

Affected Software

2 affected components

Oracle Hospitality Reporting and Analytics=8.5.1

Oracle Hospitality Reporting and Analytics=9.0.0

Remediation

Patch Available

http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html

Event History

Aug 8, 2017

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2017-10000?

CVE-2017-10000 has a high severity rating due to its ability to be exploited easily by low privileged attackers.

How do I fix CVE-2017-10000?

To fix CVE-2017-10000, upgrade Oracle Hospitality Reporting and Analytics to a patched version higher than 9.0.0.

What versions are affected by CVE-2017-10000?

CVE-2017-10000 affects Oracle Hospitality Reporting and Analytics versions 8.5.1 and 9.0.0.

Who can exploit CVE-2017-10000?

CVE-2017-10000 can be exploited by low privileged attackers with network access via HTTP.

What component is affected by CVE-2017-10000?

CVE-2017-10000 affects the Reporting component of Oracle Hospitality Applications.