Medium severity · published Jan 18, 2018
CVE-2017-10273
Vulnerability in the Oracle JDeveloper component of Oracle Fusion Middleware (subcomponent: Deployment)
4.7
CVSS
1.4%
EPSS
No
On KEV
Description
Vulnerability in the Oracle JDeveloper component of Oracle Fusion Middleware (subcomponent: Deployment). Supported versions that are affected are 11.1.1.7.0, 11.1.1.7.1, 11.1.1.9.0, 11.1.2.4.0, 12.1.3.0.0 and 12.2.1.2.0. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle JDeveloper executes to compromise Oracle JDeveloper. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle JDeveloper, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle JDeveloper accessible data as well as unauthorized read access to a subset of Oracle JDeveloper accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle JDeveloper. CVSS 3.0 Base Score 4.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:L).
CVSS vector
CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:L
Attack vector
Local
Complexity
High
Privileges
High
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 73% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JD
Jdeveloper · Oracle
11.1.1.7.0; 11.1.1.7.1; 11.1.1.9.0; 11.1.2.4.0; 12.1.3.0.0; 12.2.1.2.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-10273
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-10273
Patch
http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
Third Party Advisory
http://www.securityfocus.com/bid/102569
Third Party Advisory
http://www.securitytracker.com/id/1040207
Third Party Advisory
https://www.exploit-db.com/exploits/43848/
More from Jdeveloper
9.8
CVE-2022-21445
Oracle ADF Faces Deserialization of Untrusted Data Vulnerability
10.0
CVE-2018-14721
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to block the axis2-jaxws class…
9.8
CVE-2022-23305
By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout
9.8
CVE-2020-10683
dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks
9.8
CVE-2018-14718
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic…
