PT-2017-2024 · Oracle · Oracle Transportation Management

Publicado 2017-04-24 · Atualizado 2019-10-03 · CVE-2017-3530

Positive Technologies (AI Summary)

CVSS v2.0

7.9

Alta

Vetor base

AV:N/AC:M/Au:S/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Oracle Transportation Manager versions 6.2, 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.4.0, 6.4.1, 6.4.2

Description The issue is related to insufficient access control in the Oracle Transportation Manager component, allowing a remote attacker to gain privileged access via HTTP requests. Successful attacks require human interaction and can result in unauthorized access to critical data or all accessible data, as well as unauthorized creation, deletion, or modification of data.

Recommendations For versions 6.2, 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.4.0, 6.4.1, 6.4.2, consider restricting access to the HTTP endpoint to minimize the risk of exploitation. As a temporary workaround, consider disabling the Security subcomponent until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

BDU:2017-01191

CVE-2017-3530

Produtos afetados

Oracle Transportation Management

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2017-3530 · Nota de Segurança
• https://bdu.fstec.ru/vul/2017-01191 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-3530 · Aviso do Fabricante
• http://oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html · Aviso do Fabricante
• http://securitytracker.com/id/1038303 · Nota
• http://securityfocus.com/bid/97723 · Nota