CVE-2017-10202
CriticalSummary
Vulnerability in the OJVM component of Oracle Database Server affecting versions 11.2.0.4, 12.1.0.2, and 12.2.0.1. Easily exploitable by a low privileged attacker with network access and privileges to create sessions and procedures.
Risk Assessment
Attacks may significantly impact additional products, and successful exploitation can lead to takeover of OJVM. The high CVSS score indicates serious threats to confidentiality, integrity, and availability.
Recommendation
It is recommended to update to the latest version of Oracle Database Server to minimize the risk associated with this vulnerability.
Original NVD description (English source)
Vulnerability in the OJVM component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2 and 12.2.0.1. Easily exploitable vulnerability allows low privileged attacker having Create Session, Create Procedure privilege with network access via multiple protocols to compromise OJVM. While the vulnerability is in OJVM, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of OJVM. Note: This score is for Windows platforms. On non-Windows platforms Scope is Unchanged, giving a CVSS Base Score of 8.8. CVSS 3.0 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).