CVE-2017-10228: Vulnerability in the Oracle Hospitality Cruise Shipboard Property Management System component of Oracle Hospitality Applications (subcomponent: Module)

Medium severity · published Aug 8, 2017

CVE-2017-10228

Vulnerability in the Oracle Hospitality Cruise Shipboard Property Management System component of Oracle Hospitality Applications (subcomponent: Module)

5.4

CVSS

1.2%

EPSS

On KEV

Description

Vulnerability in the Oracle Hospitality Cruise Shipboard Property Management System component of Oracle Hospitality Applications (subcomponent: Module). The supported version that is affected is 8.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hospitality Cruise Shipboard Property Management System. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Hospitality Cruise Shipboard Property Management System accessible data as well as unauthorized read access to a subset of Oracle Hospitality Cruise Shipboard Property Management System accessible data. CVSS 3.0 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Attack vector

Network

Complexity

Low

Privileges

Low

User interaction

None

Confidentiality

Low

Integrity

Low

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)1.2% · higher than 67% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Hospitality Cruise Shipboard Property Management System · Oracle

8.0.0.0 · source: NVD

Affected product

Hospitality Cruise Shipboard Property Management System

Oracle

All Hospitality Cruise Shipboard Property Management System CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2017-10228

CVE.org

https://www.cve.org/CVERecord?id=CVE-2017-10228

Patch

http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html

Third Party Advisory

http://www.securityfocus.com/bid/99695

Third Party Advisory

http://www.securitytracker.com/id/1038941

More from Hospitality Cruise Shipboard Property Management System

8.8

CVE-2021-22112

Spring Security 5.4.x prior to 5.4.4, 5.3.x prior to 5.3.8.RELEASE, 5.2.x prior to 5.2.9.RELEASE, and older unsupported versions can fail to save the SecurityContext if it is…

8.2

CVE-2018-2621

Vulnerability in the Oracle Hospitality Cruise Shipboard Property Management System component of Oracle Hospitality Applications (subcomponent: Mobile Gangway and Mustering)

7.7

CVE-2018-3160

Vulnerability in the Oracle Hospitality Cruise Shipboard Property Management System component of Oracle Hospitality Applications (subcomponent: OHC Admin, OHC Management)

7.6

CVE-2019-2411

Vulnerability in the Oracle Hospitality Cruise Shipboard Property Management System component of Oracle Hospitality Applications (subcomponent: SPMS Suite)

7.5

CVE-2022-29885

EncryptInterceptor does not provide complete protection on insecure networks