Vulnerability Name: | CVE-2017-10028 (CCN-128802) | ||||||||||||
Assigned: | 2017-07-18 | ||||||||||||
Published: | 2017-07-18 | ||||||||||||
Updated: | 2019-10-03 | ||||||||||||
Summary: | Vulnerability in the BI Publisher component of Oracle Fusion Middleware (subcomponent: Web Server). The supported version that is affected is 11.1.1.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise BI Publisher. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in BI Publisher, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all BI Publisher accessible data as well as unauthorized update, insert or delete access to some of BI Publisher accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N). | ||||||||||||
CVSS v3 Severity: | 8.2 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N) 7.1 High (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N/E:U/RL:O/RC:C)
7.1 High (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N/E:U/RL:O/RC:C)
| ||||||||||||
CVSS v2 Severity: | 5.8 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N)
| ||||||||||||
Vulnerability Type: | CWE-noinfo | ||||||||||||
Vulnerability Consequences: | Other | ||||||||||||
References: | Source: MITRE Type: CNA CVE-2017-10028 Source: CCN Type: Oracle CPUJul2017 Oracle Critical Patch Update Advisory - July 2017 Source: CONFIRM Type: Patch, Vendor Advisory http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html Source: BID Type: Third Party Advisory, VDB Entry 99724 Source: CCN Type: BID-99724 Oracle BI Publisher CVE-2017-10028 Remote Security Vulnerability Source: SECTRACK Type: Third Party Advisory, VDB Entry 1038940 Source: XF Type: UNKNOWN oracle-cpujul2017-cve201710028(128802) | ||||||||||||
Vulnerable Configuration: | Configuration 1: Configuration CCN 1: Denotes that component is vulnerable | ||||||||||||
BACK |