Vulnerability in Oracle Hospitality Cruise Affairwhere
CVE-2017-10396
Vulnerability in the Oracle Hospitality Cruise AffairWhere component of Oracle Hospitality Applications (subcomponent: AffairWhere). Supported versions that are affected are 2.2.5.0, 2.2.6.0 and 2.2.7.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Hospitality Cruise AffairWhere executes to compromise Oracle Hospitality Cruise AffairWhere. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Hospitality Cruise AffairWhere, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Hospitality Cruise AffairWhere. CVSS 3.0 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H).
EPSS: 0.012 (65.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.9 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H.
Affected products
- Oracle Hospitality_cruise_affairwhere — versions 2.2.5.0, 2.2.6.0, 2.2.7.0
- Oracle Corporation Hospitality Cruise Affairwhere — versions 2.2.5.0, 2.2.7.0, 2.2.6.0
References
- secalert_us@oracle.com (x_refsource_CONFIRM, Patch, Vendor Advisory)
- secalert_us@oracle.com (vdb-entry, x_refsource_BID)
Frequently asked questions
- What is CVE-2017-10396?
- CVE-2017-10396 is a critical-severity vulnerability in Oracle Hospitality Cruise Affairwhere. CVSS score: 9.9/10. Published 2017-10-19.
- How severe is CVE-2017-10396?
- Critical severity. CVSS v3 base score is 9.9 out of 10.