Security restrictions bypass in Identity Manager - CVE-2017-10151

Vulnerability identifier: #VU9014

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-10151

CWE-ID: CWE-284

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to bypass security restrictions on the target system.

The weakness exists due to an error in the Oracle Identity Manager component of Oracle Fusion Middleware (subcomponent: Default Account). A remote attacker with network access via HTTP can compromise Oracle Identity Manager.

Successful exploitation of the vulnerability may result in takeover of Oracle Identity Manager.

Identity Manager

Install update from vendor's website.

• Exploit #2349 - OracleCVE (Vulnerabilities which found in Oracle products) (April 7, 2020)

• http://www.oracle.com/ocom/groups/public/@otn/documents/webcontent/4016515.xml

• Security restrictions bypass in Oracle Identity Manager