Medium severity · published Nov 14, 2017
CVE-2017-10266
Vulnerability in the Oracle Tuxedo component of Oracle Fusion Middleware (subcomponent: Core)
5.3
CVSS
1.1%
EPSS
No
On KEV
Description
Vulnerability in the Oracle Tuxedo component of Oracle Fusion Middleware (subcomponent: Core). Supported versions that are affected are 11.1.1, 12.1.1, 12.1.3 and 12.2.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via Jolt to compromise Oracle Tuxedo. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Tuxedo accessible data. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 65% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TU
Tuxedo · Oracle
11.1.1; 12.1.1; 12.1.3; 12.2.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-10266
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-10266
Patch
http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-10269-4021872.html
Third Party Advisory
http://www.securityfocus.com/bid/101852
More from Tuxedo
10.0
CVE-2017-10269
Vulnerability in the Oracle Tuxedo component of Oracle Fusion Middleware (subcomponent: Core)
9.9
CVE-2017-10272
Vulnerability in the Oracle Tuxedo component of Oracle Fusion Middleware (subcomponent: Core)
9.8
CVE-2022-23305
By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout
8.8
CVE-2022-23307
CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw
8.8
CVE-2022-23302
JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration…