CVE-2017-10093: Infoleak

Published Aug 8, 2017

Updated

Vulnerability in the Oracle Agile PLM component of Oracle Supply Chain Products Suite (subcomponent: Security). Supported versions that are affected are 9.3.5 and 9.3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Agile PLM accessible data. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

Affected Software

4 affected components

Oracle Agile Product Lifecycle Management Framework=9.3.5

Oracle Agile Product Lifecycle Management Framework=9.3.6

Oracle Agile Product Lifecycle Management=9.3.5

Oracle Agile Product Lifecycle Management=9.3.6

Remediation

Patch Available

http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html

Event History

Aug 8, 2017

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2017-10093?

CVE-2017-10093 is considered to be an easily exploitable vulnerability which poses a significant risk to Oracle Agile PLM.

How do I fix CVE-2017-10093?

To remediate CVE-2017-10093, upgrade to a version of Oracle Agile PLM that is not affected, specifically versions 9.3.5 or 9.3.6.

What component is affected by CVE-2017-10093?

CVE-2017-10093 affects the Oracle Agile PLM component of the Oracle Supply Chain Products Suite.

Who can exploit CVE-2017-10093?

CVE-2017-10093 can be exploited by an unauthenticated attacker with network access via HTTP.

What versions of Oracle Agile PLM are impacted by CVE-2017-10093?

The impacted versions of Oracle Agile PLM are 9.3.5 and 9.3.6.