Quantum Secular Labs / Blog / Advisories

CVE-2017-10396: Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where…

CVE-2017-10396 is rated critical with a CVSS v3.0 base score of 9.9 and affects Oracle Hospitality Cruise Affairwhere. Per its scoring, it can be exploited over the network, without any user interaction.

Vulnerability description

Vulnerability in the Oracle Hospitality Cruise AffairWhere component of Oracle Hospitality Applications (subcomponent: AffairWhere). Supported versions that are affected are 2.2.5.0, 2.2.6.0 and 2.2.7.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Hospitality Cruise AffairWhere executes to compromise Oracle Hospitality Cruise AffairWhere. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Hospitality Cruise AffairWhere, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Hospitality Cruise AffairWhere. CVSS 3.0 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H).

Severity breakdown

CVSS v3.0 9.9: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H

  • Attack vector: Network. Exploitable remotely over the network, with no need for local or physical access.
  • Attack complexity: Low. No special conditions; the attack can be repeated reliably.
  • Privileges required: Low. A basic user account is enough.
  • User interaction: None. No action from any user is needed.
  • Scope: Changed. Impact reaches beyond the vulnerable component to other resources.
  • Confidentiality impact: Low. Some information is exposed.
  • Integrity impact: High. Total loss of integrity; data or system state can be fully modified.
  • Availability impact: High. Total loss of availability; the component can be shut down.

Affected products

  • Oracle Hospitality Cruise Affairwhere: 2.2.5.0; 2.2.6.0; 2.2.7.0

References