2.3

CVE-2017-10292

Vulnerability in the RDBMS Security component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2 and 12.2.0.1. Easily exploitable vulnerability allows high privileged attacker having Create User privilege with logon to the infrastructure where RDBMS Security executes to compromise RDBMS Security. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of RDBMS Security accessible data. CVSS 3.0 Base Score 2.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N).

Data is provided by the National Vulnerability Database (NVD)
Oracle ≫ Database Version11.2.0.4
Oracle ≫ Database Version12.1.0.2
Oracle ≫ Database Version12.2.0.1
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.07% 0.174
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 2.3 0.8 1.4
CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
nvd@nist.gov 1.7 3.1 2.9
AV:L/AC:L/Au:S/C:N/I:P/A:N
CWE-269 Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

http://www.securitytracker.com/id/1039591
Third Party Advisory
VDB Entry
http://www.securityfocus.com/bid/101350
Third Party Advisory
VDB Entry