CVE-2017-10375: Medium severity oracle hospitality guest access vulnerability

Published Oct 19, 2017

Updated

Vulnerability in the Oracle Hospitality Guest Access component of Oracle Hospitality Applications (subcomponent: Base). Supported versions that are affected are 4.2.0 and 4.2.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hospitality Guest Access. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Hospitality Guest Access accessible data as well as unauthorized read access to a subset of Oracle Hospitality Guest Access accessible data. CVSS 3.0 Base Score 4.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N).

Affected Software

2 affected components

Oracle Hospitality Guest Access=4.2.0

Oracle Hospitality Guest Access=4.2.1

Remediation

Patch Available

http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

Event History

Oct 19, 2017

CVE Published

via MITRE·05:00 PM

Data Sourced

via MITRE·05:00 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2017-10375?

CVE-2017-10375 is classified as an easily exploitable vulnerability with low complexity that could lead to unauthorized access.

How do I fix CVE-2017-10375?

To mitigate CVE-2017-10375, it is recommended to upgrade Oracle Hospitality Guest Access to version 4.2.2 or later.

Who is affected by CVE-2017-10375?

CVE-2017-10375 affects users of Oracle Hospitality Guest Access versions 4.2.0 and 4.2.1.

What type of attack is possible with CVE-2017-10375?

CVE-2017-10375 allows a low privileged attacker to exploit the vulnerability via HTTP network access.

Is there a workaround for CVE-2017-10375?

There are no publicly documented workarounds for CVE-2017-10375; upgrading is the recommended approach.