CVE-2017-10033 json
Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Support Tools).
published 2017-10-19 9 y ago modified 2026-06-17 4 mo ago also EUVD-2017-1680
- cvss
- 4.0
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.3%
- EPSS 2.3% chance of exploitation in 30 days, percentile 83%
- public exploits
- 1
- Exploit-DB
Summary
Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Support Tools). Supported versions that are affected are 11.1.1.8.0 and 12.2.1.2.0. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle WebCenter Sites executes to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle WebCenter Sites accessible data as well as unauthorized read access to a subset of Oracle WebCenter Sites accessible data. Note: Please refer to Doc ID <a href="http://support.oracle.com/CSP/main/article?cmd=show&type=NOT&id=2318213.1">My Oracle Support Note 2318213.1 for instructions on how to address this issue. CVSS 3.0 Base Score 4.0 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).
Patch / fix
Timeline
- Published
- First public exploit (EDB-44757)
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
2.33% chance of exploitation in the next 30 days, higher than 83% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- EDB-44757 Oracle WebCenter FatWire Content Server < 7 - Improper Access Control webapps, 2018-05-25
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 4.0 | CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N |
| NVD | 2.0 | 3.3 | AV:L/AC:M/Au:N/C:P/I:P/A:N |
Affected products
- Oracle Corporation WebCenter Sites
References
-
oracle.com
/technetwork/security-advisory/cpuoct2017-3236626.html
patch, vendor-advisory
-
exploit-db.com
/exploits/44757/
exploit
-
securitytracker.com
/id/1039602
vdb-entry, third-party-advisory
-
securityfocus.com
/bid/101408
vdb-entry, third-party-advisory
Sources
- CVE List CVE-2017-10033
- NVD CVE-2017-10033
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.