{"api_version":"1","generated_at":"2026-05-30T08:13:47+00:00","cve":"CVE-2017-10332","urls":{"html":"https://cve.report/CVE-2017-10332","api":"https://cve.report/api/cve/CVE-2017-10332.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2017-10332","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2017-10332"},"summary":{"title":"CVE-2017-10332","description":"Vulnerability in the Oracle Universal Work Queue component of Oracle E-Business Suite (subcomponent: Administration). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Universal Work Queue. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Universal Work Queue accessible data. CVSS 3.0 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","state":"PUBLISHED","assigner":"oracle","published_at":"2017-10-19 17:29:03","updated_at":"2025-04-20 01:37:25"},"problem_types":["CWE-200","Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Universal Work Queue.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Universal Work Queue accessible data."],"metrics":[{"version":"3.0","source":"nvd@nist.gov","type":"Primary","score":"7.5","severity":"HIGH","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","data":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"}},{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"5","severity":"","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","baseScore":5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"}}],"references":[{"url":"http://www.securitytracker.com/id/1039592","name":"http://www.securitytracker.com/id/1039592","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"],"title":"Oracle E-Business Suite Multiple Flaws Let Remote Users Access and Modify Data on the Target System - SecurityTracker","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/101376","name":"http://www.securityfocus.com/bid/101376","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"],"title":"Oracle E-Business Suite CVE-2017-10332 Remote Security Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","name":"http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"],"title":"Oracle Critical Patch Update - October 2017","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-10332","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-10332","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Oracle Corporation","product":"Universal Work Queue","version":"affected 12.1.1","platforms":[]},{"source":"CNA","vendor":"Oracle Corporation","product":"Universal Work Queue","version":"affected 12.1.2","platforms":[]},{"source":"CNA","vendor":"Oracle Corporation","product":"Universal Work Queue","version":"affected 12.1.3","platforms":[]},{"source":"CNA","vendor":"Oracle Corporation","product":"Universal Work Queue","version":"affected 12.2.3","platforms":[]},{"source":"CNA","vendor":"Oracle Corporation","product":"Universal Work Queue","version":"affected 12.2.4","platforms":[]},{"source":"CNA","vendor":"Oracle Corporation","product":"Universal Work Queue","version":"affected 12.2.5","platforms":[]},{"source":"CNA","vendor":"Oracle Corporation","product":"Universal Work Queue","version":"affected 12.2.6","platforms":[]},{"source":"CNA","vendor":"Oracle Corporation","product":"Universal Work Queue","version":"affected 12.2.7","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2017","cve_id":"10332","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"oracle","cpe5":"universal_work_queue","cpe6":"12.1.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"10332","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"oracle","cpe5":"universal_work_queue","cpe6":"12.1.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"10332","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"oracle","cpe5":"universal_work_queue","cpe6":"12.1.3","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"10332","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"oracle","cpe5":"universal_work_queue","cpe6":"12.2.3","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"10332","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"oracle","cpe5":"universal_work_queue","cpe6":"12.2.4","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"10332","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"oracle","cpe5":"universal_work_queue","cpe6":"12.2.5","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"10332","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"oracle","cpe5":"universal_work_queue","cpe6":"12.2.6","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"10332","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"oracle","cpe5":"universal_work_queue","cpe6":"12.2.7","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-05T17:41:54.895Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html"},{"name":"101376","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/101376"},{"name":"1039592","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://www.securitytracker.com/id/1039592"}],"title":"CVE Program Container"},{"metrics":[{"other":{"content":{"id":"CVE-2017-10332","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2024-10-04T15:35:31.695902Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2024-10-04T16:51:07.443Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"product":"Universal Work Queue","vendor":"Oracle Corporation","versions":[{"status":"affected","version":"12.1.1"},{"status":"affected","version":"12.1.2"},{"status":"affected","version":"12.1.3"},{"status":"affected","version":"12.2.3"},{"status":"affected","version":"12.2.4"},{"status":"affected","version":"12.2.5"},{"status":"affected","version":"12.2.6"},{"status":"affected","version":"12.2.7"}]}],"datePublic":"2017-10-17T00:00:00.000Z","descriptions":[{"lang":"en","value":"Vulnerability in the Oracle Universal Work Queue component of Oracle E-Business Suite (subcomponent: Administration). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Universal Work Queue. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Universal Work Queue accessible data. CVSS 3.0 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)."}],"problemTypes":[{"descriptions":[{"description":"Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Universal Work Queue.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Universal Work Queue accessible data.","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-10-20T09:57:01.000Z","orgId":"43595867-4340-4103-b7a2-9a5208d29a85","shortName":"oracle"},"references":[{"tags":["x_refsource_CONFIRM"],"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html"},{"name":"101376","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/101376"},{"name":"1039592","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://www.securitytracker.com/id/1039592"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"secalert_us@oracle.com","ID":"CVE-2017-10332","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Universal Work Queue","version":{"version_data":[{"version_affected":"=","version_value":"12.1.1"},{"version_affected":"=","version_value":"12.1.2"},{"version_affected":"=","version_value":"12.1.3"},{"version_affected":"=","version_value":"12.2.3"},{"version_affected":"=","version_value":"12.2.4"},{"version_affected":"=","version_value":"12.2.5"},{"version_affected":"=","version_value":"12.2.6"},{"version_affected":"=","version_value":"12.2.7"}]}}]},"vendor_name":"Oracle Corporation"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Vulnerability in the Oracle Universal Work Queue component of Oracle E-Business Suite (subcomponent: Administration). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Universal Work Queue. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Universal Work Queue accessible data. CVSS 3.0 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Universal Work Queue.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Universal Work Queue accessible data."}]}]},"references":{"reference_data":[{"name":"http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","refsource":"CONFIRM","url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html"},{"name":"101376","refsource":"BID","url":"http://www.securityfocus.com/bid/101376"},{"name":"1039592","refsource":"SECTRACK","url":"http://www.securitytracker.com/id/1039592"}]}}}},"cveMetadata":{"assignerOrgId":"43595867-4340-4103-b7a2-9a5208d29a85","assignerShortName":"oracle","cveId":"CVE-2017-10332","datePublished":"2017-10-19T17:00:00.000Z","dateReserved":"2017-06-21T00:00:00.000Z","dateUpdated":"2024-10-04T16:51:07.443Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2017-10-19 17:29:03","lastModifiedDate":"2025-04-20 01:37:25","problem_types":["CWE-200","Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Universal Work Queue.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Universal Work Queue accessible data."],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","baseScore":5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:universal_work_queue:12.1.1:*:*:*:*:*:*:*","matchCriteriaId":"933006D7-EF09-4CB5-BEA0-248625F74FFC"},{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:universal_work_queue:12.1.2:*:*:*:*:*:*:*","matchCriteriaId":"F917BA76-6DC0-431B-915A-E29AD635A316"},{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:universal_work_queue:12.1.3:*:*:*:*:*:*:*","matchCriteriaId":"2769037E-6154-47BF-BF90-03DA704706E8"},{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:universal_work_queue:12.2.3:*:*:*:*:*:*:*","matchCriteriaId":"91551403-6301-417C-B0E5-89819163D28D"},{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:universal_work_queue:12.2.4:*:*:*:*:*:*:*","matchCriteriaId":"A60045D6-BDDB-4EA7-9406-72D9522C7523"},{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:universal_work_queue:12.2.5:*:*:*:*:*:*:*","matchCriteriaId":"D3194BAB-4DA8-4465-9D2D-4C5F1D598F31"},{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:universal_work_queue:12.2.6:*:*:*:*:*:*:*","matchCriteriaId":"F6A46E76-BF9A-43C9-A95F-7BD59EF2C6CF"},{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:universal_work_queue:12.2.7:*:*:*:*:*:*:*","matchCriteriaId":"D2EC03D0-68A5-4FBE-8A7D-6ACF23B7399A"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2017","CveId":"10332","Ordinal":"1","Title":"CVE-2017-10332","CVE":"CVE-2017-10332","Year":"2017"},"notes":[{"CveYear":"2017","CveId":"10332","Ordinal":"1","NoteData":"Vulnerability in the Oracle Universal Work Queue component of Oracle E-Business Suite (subcomponent: Administration). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Universal Work Queue. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Universal Work Queue accessible data. CVSS 3.0 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","Type":"Description","Title":"CVE-2017-10332"},{"CveYear":"2017","CveId":"10332","Ordinal":"2","NoteData":"2017-10-19","Type":"Other","Title":"Published"},{"CveYear":"2017","CveId":"10332","Ordinal":"3","NoteData":"2017-10-20","Type":"Other","Title":"Modified"}]}}}