CVE-2017-10046: Medium severity oracle primavera p6 enterprise project portfolio management vulnerability
Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Primavera Products Suite (subcomponent: Web Access). Supported versions that are affected are 8.3, 8.4, 15.1, 15.2 and 16.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Primavera P6 Enterprise Project Portfolio Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Primavera P6 Enterprise Project Portfolio Management, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Primavera P6 Enterprise Project Portfolio Management accessible data as well as unauthorized read access to a subset of Primavera P6 Enterprise Project Portfolio Management accessible data. CVSS 3.0 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2017-10046?
CVE-2017-10046 is rated as easily exploitable with low privileges needed for an attacker to exploit.
How do I fix CVE-2017-10046?
To fix CVE-2017-10046, upgrade to secure versions of Oracle Primavera P6 Enterprise Project Portfolio Management as specified in the security advisory.
Which versions of Oracle Primavera are affected by CVE-2017-10046?
Affected versions include 8.3, 8.4, 15.1, 15.2, and 16.1 of Oracle Primavera P6 Enterprise Project Portfolio Management.
Can CVE-2017-10046 be exploited remotely?
Yes, CVE-2017-10046 can be exploited remotely by an attacker with network access.
What type of vulnerability is CVE-2017-10046 classified as?
CVE-2017-10046 is classified as an easily exploitable vulnerability in the Web Access component.