#VU9014 Security restrictions bypass in Identity Manager - CVE-2017-10151
Published: October 31, 2017 / Updated: April 7, 2020
Vulnerability identifier: #VU9014
Vulnerability risk: High
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Amber
CVE-ID: CVE-2017-10151
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vulnerable software:
Identity Manager
Identity Manager
Software vendor:
Oracle
Oracle
Description
The vulnerability allows a remote attacker to bypass security restrictions on the target system.
The weakness exists due to an error in the Oracle Identity Manager component of Oracle Fusion Middleware (subcomponent: Default Account). A remote attacker with network access via HTTP can compromise Oracle Identity Manager.
Successful exploitation of the vulnerability may result in takeover of Oracle Identity Manager.
The weakness exists due to an error in the Oracle Identity Manager component of Oracle Fusion Middleware (subcomponent: Default Account). A remote attacker with network access via HTTP can compromise Oracle Identity Manager.
Successful exploitation of the vulnerability may result in takeover of Oracle Identity Manager.
Remediation
Install update from vendor's website.