CVE-2017-10009: Medium severity oracle flexcube private banking vulnerability

Published Aug 8, 2017

Updated

Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Miscellaneous). Supported versions that are affected are 2.0.0, 2.0.1, 2.2.0 and 12.0.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Private Banking. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle FLEXCUBE Private Banking accessible data. CVSS 3.0 Base Score 4.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N).

Affected Software

4 affected components

Oracle FLEXCUBE Private Banking=2.0.0

Oracle FLEXCUBE Private Banking=2.0.1

Oracle FLEXCUBE Private Banking=2.2.0

Oracle FLEXCUBE Private Banking=12.0.1

Remediation

Patch Available

http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html

Event History

Aug 8, 2017

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2017-10009?

CVE-2017-10009 is considered a relatively high severity vulnerability due to its potential for exploitation by low-privileged attackers.

How do I fix CVE-2017-10009?

To remediate CVE-2017-10009, it is recommended to apply the latest security patches provided by Oracle for the affected FLEXCUBE versions.

Which versions are affected by CVE-2017-10009?

CVE-2017-10009 affects Oracle FLEXCUBE Private Banking versions 2.0.0, 2.0.1, 2.2.0, and 12.0.1.

What types of attacks can exploit CVE-2017-10009?

CVE-2017-10009 can be exploited by low-privileged attackers with network access, enabling unauthorized actions.

Is there a workaround for CVE-2017-10009?

While applying security patches is the recommended solution, specific workarounds are not generally provided for CVE-2017-10009.