CVE-2017-10404
CriticalSummary
Vulnerability in the Oracle Hospitality Reporting and Analytics component of Oracle Hospitality Applications (subcomponent: iQuery) allows easy exploitation by a low privileged attacker with network access via HTTP. This can lead to the takeover of Oracle Hospitality Reporting and Analytics, significantly impacting additional products.
Risk Assessment
Successful attacks can result in the takeover of Oracle Hospitality Reporting and Analytics, posing serious threats to the confidentiality, integrity, and availability of data.
Recommendation
It is recommended to update to the latest version of the software and implement appropriate security measures to restrict access to the component only to trusted users.
Original NVD description (English source)
Vulnerability in the Oracle Hospitality Reporting and Analytics component of Oracle Hospitality Applications (subcomponent: iQuery). Supported versions that are affected are 8.5.1 and 9.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hospitality Reporting and Analytics. While the vulnerability is in Oracle Hospitality Reporting and Analytics, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Hospitality Reporting and Analytics. CVSS 3.0 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L).