CVE-2017-10292: Low severity ibm security identity manager vulnerability
An unspecified vulnerability in Oracle Database Server related to the RDBMS Security component could allow an authenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact.
Other sources
Vulnerability in the RDBMS Security component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2 and 12.2.0.1. Easily exploitable vulnerability allows high privileged attacker having Create User privilege with logon to the infrastructure where RDBMS Security executes to compromise RDBMS Security. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of RDBMS Security accessible data. CVSS 3.0 Base Score 2.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N).
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2017-10292?
The severity of CVE-2017-10292 is low with a severity value of 2.3.
What is the affected software for CVE-2017-10292?
The affected software for CVE-2017-10292 is Oracle Database Server versions 11.2.0.4, 12.1.0.2, and 12.2.0.1, as well as IBM ISIM VA versions 7.0.2 and 7.0.1.
Is CVE-2017-10292 easily exploitable?
Yes, CVE-2017-10292 is easily exploitable.
What privileges does an attacker need to exploit CVE-2017-10292?
An attacker with high privileges having Create User privilege with logon to the infrastructure where RDBMS Security executes can exploit CVE-2017-10292.
Is there a patch or fix available for CVE-2017-10292?
Yes, Oracle has provided a security advisory with information on how to address CVE-2017-10292. Please refer to the Oracle website for more details.