CVE-2017-10154: Infoleak

Published Oct 19, 2017

Updated

Vulnerability in the Oracle Access Manager component of Oracle Fusion Middleware (subcomponent: Web Server Plugin). The supported version that is affected is 11.1.2.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Access Manager accessible data. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

Affected Software

1 affected component

Oracle Access Manager=11.1.2.3.0

Remediation

Patch Available

http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

Event History

Oct 19, 2017

CVE Published

via MITRE·05:00 PM

Data Sourced

via MITRE·05:00 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2017-10154?

The severity of CVE-2017-10154 is high due to its ability to allow unauthenticated attackers to exploit the vulnerability remotely.

How do I fix CVE-2017-10154?

To fix CVE-2017-10154, it is recommended to apply the latest patches provided by Oracle for Oracle Access Manager version 11.1.2.3.0.

Who is affected by CVE-2017-10154?

CVE-2017-10154 affects users of Oracle Access Manager version 11.1.2.3.0 and its Web Server Plugin.

What type of vulnerability is CVE-2017-10154?

CVE-2017-10154 is a remotely exploitable vulnerability that allows attackers to compromise Oracle Access Manager via HTTP.

Is CVE-2017-10154 easily exploitable?

Yes, CVE-2017-10154 is considered easily exploitable, allowing attackers with network access to attack the system without authentication.