VulnerabilityModified

CVE-2017-10245

Vulnerability in the Oracle General Ledger component of Oracle E-Business Suite (subcomponent: Account Hierarchy Manager).

HIGH 7.5EPSS 2.60%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (2.60%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Vulnerability in the Oracle General Ledger component of Oracle E-Business Suite (subcomponent: Account Hierarchy Manager). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle General Ledger. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle General Ledger accessible data. CVSS 3.0 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

CVSS 3.0: 7.5 HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS: 2.60% probability · 84th percentile
CISA KEV: Not listed
Affected: oracle/general ledger
Source: secalert_us@oracle.com

References

http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.htmlPatch, Vendor Advisory
http://www.securityfocus.com/bid/99690Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1038926Third Party Advisory, VDB Entry
http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.htmlPatch, Vendor Advisory
http://www.securityfocus.com/bid/99690Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1038926Third Party Advisory, VDB Entry

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.