CVE-2017-10037: Infoleak

Published Oct 19, 2017

Updated

Vulnerability in the Oracle BI Publisher component of Oracle Fusion Middleware (subcomponent: Web Service API). Supported versions that are affected are 11.1.1.7.0 and 11.1.1.9.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle BI Publisher. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle BI Publisher accessible data. CVSS 3.0 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Affected Software

2 affected components

Oracle Business Intelligence Publisher=11.1.1.7.0

Oracle Business Intelligence Publisher=11.1.1.9.0

Remediation

Patch Available

http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

Event History

Oct 19, 2017

CVE Published

via MITRE·05:00 PM

Data Sourced

via MITRE·05:00 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2017-10037?

CVE-2017-10037 has a high severity rating due to its potential for exploitation by unauthenticated attackers.

How do I fix CVE-2017-10037?

To fix CVE-2017-10037, it is recommended to apply the necessary security patches provided by Oracle for affected versions.

Which versions are affected by CVE-2017-10037?

CVE-2017-10037 affects Oracle BI Publisher versions 11.1.1.7.0 and 11.1.1.9.0.

What type of attack can exploit CVE-2017-10037?

CVE-2017-10037 can be exploited by an unauthenticated attacker remotely via HTTP to compromise the system.

Is user authentication required to exploit CVE-2017-10037?

No, CVE-2017-10037 can be exploited without user authentication.