CVE-2017-10151
CriticalSummary
Vulnerability in the Oracle Identity Manager component of Oracle Fusion Middleware allows an unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager. Affected versions are 11.1.1.7, 11.1.2.3, and 12.2.1.3.
Risk Assessment
An attacker can take over Oracle Identity Manager, which may significantly impact additional products. The high CVSS score of 10.0 indicates a serious threat to confidentiality, integrity, and availability.
Recommendation
It is recommended to upgrade to the latest version of Oracle Fusion Middleware to mitigate the risk associated with this vulnerability.
Original NVD description (English source)
Vulnerability in the Oracle Identity Manager component of Oracle Fusion Middleware (subcomponent: Default Account). Supported versions that are affected are 11.1.1.7, 11.1.2.3 and 12.2.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager. While the vulnerability is in Oracle Identity Manager, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager. CVSS 3.0 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).