PT-2017-11102 · Oracle · Java Advanced Management Console

Published 2017-08-08 · Updated 2019-10-03 · CVE-2017-10104

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Java Advanced Management Console version 2.6

Description The issue allows a low-privileged attacker with network access via HTTP to compromise Java Advanced Management Console, potentially impacting additional products. Successful attacks can result in unauthorized access to data, including update, insert, or delete access to some data and read access to a subset of data. It can also cause a partial denial of service of Java Advanced Management Console.

Recommendations For Java Advanced Management Console version 2.6, update to a version that includes a fix for this issue. If no such version is available, consider restricting network access to the Java Advanced Management Console component to minimize the risk of exploitation.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2017-10104

Affected Products

Java Advanced Management Console

References · 6

• https://osv.dev/vulnerability/CVE-2017-10104 · Vendor Advisory
• http://oracle.com/technetwork/security-advisory/cpujul2017-3236622.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-10104 · Security Note
• https://security.netapp.com/advisory/ntap-20170720-0001 · Note
• http://securityfocus.com/bid/99797 · Note
• http://securitytracker.com/id/1038931 · Note