Modification of information in JRockit and Oracle Java SE - CVE-2017-3252
Published: July 5, 2017 / Updated: November 22, 2018
Vulnerability identifier: #VU7332
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2017-3252
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Oracle
Affected software:
JRockit
Oracle Java SE
JRockit
Oracle Java SE
Detailed vulnerability description
The vulnerability allows a remote authenticated attacker to modify information.
The weakness exists due to unknown error in Oracle Java SE Java SE Embedded and Jrockit related to the JAAS component. A remote attacker can trick the victim into visiting a specially crafted webpage and modify arbitrary data on the system.
The weakness exists due to unknown error in Oracle Java SE Java SE Embedded and Jrockit related to the JAAS component. A remote attacker can trick the victim into visiting a specially crafted webpage and modify arbitrary data on the system.
How to mitigate CVE-2017-3252
Install update from vendor's website.