Vulnerability Details : CVE-2017-10173
Vulnerability in the Oracle Retail Open Commerce Platform component of Oracle Retail Applications (subcomponent: Website). Supported versions that are affected are 5.0, 5.1, 5.2, 5.3, 6.0, 6.1, 15.0 and 15.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Open Commerce Platform. While the vulnerability is in Oracle Retail Open Commerce Platform, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Retail Open Commerce Platform accessible data. CVSS 3.0 Base Score 5.8 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N).
Exploit prediction scoring system (EPSS) score for CVE-2017-10173
Probability of exploitation activity in the next 30 days: 0.17%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 53 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2017-10173
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
|---|---|---|---|---|---|
|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:N/I:P/A:N |
10.0
|
2.9
|
NIST |
|
5.8
|
MEDIUM | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N |
3.9
|
1.4
|
NIST |
References for CVE-2017-10173
-
http://www.securityfocus.com/bid/99745
Oracle Retail Open Commerce Platform CVE-2017-10173 Remote Security VulnerabilityThird Party Advisory;VDB Entry
-
http://www.securitytracker.com/id/1038944
Oracle Retail Applications Flaws Let Remote Users Access and Modify Data and Gain Elevated Privileges on the Target System - SecurityTrackerThird Party Advisory;VDB Entry
-
http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
Oracle Critical Patch Update - July 2017Patch;Vendor Advisory
Products affected by CVE-2017-10173
- cpe:2.3:a:oracle:retail_open_commerce_platform_cloud_service:5.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_open_commerce_platform_cloud_service:15.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_open_commerce_platform_cloud_service:5.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_open_commerce_platform_cloud_service:5.3:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_open_commerce_platform_cloud_service:5.2:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_open_commerce_platform_cloud_service:6.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_open_commerce_platform_cloud_service:6.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_open_commerce_platform_cloud_service:15.0:*:*:*:*:*:*:*