Security restrictions bypass in Identity Manager - CVE-2017-10151
Published: October 31, 2017 / Updated: April 7, 2020
Vulnerability identifier: #VU9014
CSH Severity: High
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Amber
CVE-ID: CVE-2017-10151
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vendor: Oracle
Affected software:
Identity Manager
Identity Manager
Detailed vulnerability description
The vulnerability allows a remote attacker to bypass security restrictions on the target system.
The weakness exists due to an error in the Oracle Identity Manager component of Oracle Fusion Middleware (subcomponent: Default Account). A remote attacker with network access via HTTP can compromise Oracle Identity Manager.
Successful exploitation of the vulnerability may result in takeover of Oracle Identity Manager.
The weakness exists due to an error in the Oracle Identity Manager component of Oracle Fusion Middleware (subcomponent: Default Account). A remote attacker with network access via HTTP can compromise Oracle Identity Manager.
Successful exploitation of the vulnerability may result in takeover of Oracle Identity Manager.
How to mitigate CVE-2017-10151
Install update from vendor's website.