{"api_version":"1","generated_at":"2026-07-23T09:58:16+00:00","cve":"CVE-2017-10369","urls":{"html":"https://cve.report/CVE-2017-10369","api":"https://cve.report/api/cve/CVE-2017-10369.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2017-10369","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2017-10369"},"summary":{"title":"CVE-2017-10369","description":"Vulnerability in the Oracle Virtual Directory component of Oracle Fusion Middleware (subcomponent: Virtual Directory Server). Supported versions that are affected are 11.1.1.7.0 and 11.1.1.9.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Virtual Directory. Successful attacks of this vulnerability can result in takeover of Oracle Virtual Directory. CVSS 3.0 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","state":"PUBLISHED","assigner":"oracle","published_at":"2017-10-19 17:29:04","updated_at":"2025-04-20 01:37:25"},"problem_types":["NVD-CWE-noinfo","Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Virtual Directory.  Successful attacks of this vulnerability can result in takeover of Oracle Virtual Directory."],"metrics":[{"version":"3.0","source":"nvd@nist.gov","type":"Primary","score":"7.5","severity":"HIGH","vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"6","severity":"","vector":"AV:N/AC:M/Au:S/C:P/I:P/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:S/C:P/I:P/A:P","baseScore":6,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"http://www.securityfocus.com/bid/101301","name":"http://www.securityfocus.com/bid/101301","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Oracle Virtual Directory CVE-2017-10369 Remote Security Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","name":"http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"],"title":"Oracle Critical Patch Update - October 2017","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securitytracker.com/id/1039602","name":"http://www.securitytracker.com/id/1039602","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Oracle Fusion Middleware Multiple Flaws Let Remote Authentacated Users Gain Elevated Privileges, Remote and Local Users Access and Modify Data, and Local Users Deny Service - SecurityTracker","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-10369","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-10369","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Oracle Corporation","product":"Oracle Virtual Directory","version":"affected 11.1.1.7.0","platforms":[]},{"source":"CNA","vendor":"Oracle Corporation","product":"Oracle Virtual Directory","version":"affected 11.1.1.9.0","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2017","cve_id":"10369","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"oracle","cpe5":"virtual_directory","cpe6":"11.1.1.7.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"10369","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"oracle","cpe5":"virtual_directory","cpe6":"11.1.1.9.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-05T17:41:55.453Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"1039602","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://www.securitytracker.com/id/1039602"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html"},{"name":"101301","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/101301"}],"title":"CVE Program Container"},{"metrics":[{"other":{"content":{"id":"CVE-2017-10369","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2024-10-04T15:38:57.789808Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2024-10-04T16:46:53.269Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"product":"Oracle Virtual Directory","vendor":"Oracle Corporation","versions":[{"status":"affected","version":"11.1.1.7.0"},{"status":"affected","version":"11.1.1.9.0"}]}],"datePublic":"2017-10-17T00:00:00.000Z","descriptions":[{"lang":"en","value":"Vulnerability in the Oracle Virtual Directory component of Oracle Fusion Middleware (subcomponent: Virtual Directory Server). Supported versions that are affected are 11.1.1.7.0 and 11.1.1.9.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Virtual Directory. Successful attacks of this vulnerability can result in takeover of Oracle Virtual Directory. CVSS 3.0 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)."}],"problemTypes":[{"descriptions":[{"description":"Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Virtual Directory.  Successful attacks of this vulnerability can result in takeover of Oracle Virtual Directory.","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-10-20T09:57:01.000Z","orgId":"43595867-4340-4103-b7a2-9a5208d29a85","shortName":"oracle"},"references":[{"name":"1039602","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://www.securitytracker.com/id/1039602"},{"tags":["x_refsource_CONFIRM"],"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html"},{"name":"101301","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/101301"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"secalert_us@oracle.com","ID":"CVE-2017-10369","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Oracle Virtual Directory","version":{"version_data":[{"version_affected":"=","version_value":"11.1.1.7.0"},{"version_affected":"=","version_value":"11.1.1.9.0"}]}}]},"vendor_name":"Oracle Corporation"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Vulnerability in the Oracle Virtual Directory component of Oracle Fusion Middleware (subcomponent: Virtual Directory Server). Supported versions that are affected are 11.1.1.7.0 and 11.1.1.9.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Virtual Directory. Successful attacks of this vulnerability can result in takeover of Oracle Virtual Directory. CVSS 3.0 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Virtual Directory.  Successful attacks of this vulnerability can result in takeover of Oracle Virtual Directory."}]}]},"references":{"reference_data":[{"name":"1039602","refsource":"SECTRACK","url":"http://www.securitytracker.com/id/1039602"},{"name":"http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","refsource":"CONFIRM","url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html"},{"name":"101301","refsource":"BID","url":"http://www.securityfocus.com/bid/101301"}]}}}},"cveMetadata":{"assignerOrgId":"43595867-4340-4103-b7a2-9a5208d29a85","assignerShortName":"oracle","cveId":"CVE-2017-10369","datePublished":"2017-10-19T17:00:00.000Z","dateReserved":"2017-06-21T00:00:00.000Z","dateUpdated":"2024-10-04T16:46:53.269Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2017-10-19 17:29:04","lastModifiedDate":"2025-04-20 01:37:25","problem_types":["NVD-CWE-noinfo","Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Virtual Directory.  Successful attacks of this vulnerability can result in takeover of Oracle Virtual Directory."],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:S/C:P/I:P/A:P","baseScore":6,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":6.8,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:virtual_directory:11.1.1.7.0:*:*:*:*:*:*:*","matchCriteriaId":"107268A5-D6D6-4DF2-BBA0-AF5B5854887E"},{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:virtual_directory:11.1.1.9.0:*:*:*:*:*:*:*","matchCriteriaId":"0353A60E-9D18-45D9-AE01-DB645EABB764"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2017","CveId":"10369","Ordinal":"1","Title":"CVE-2017-10369","CVE":"CVE-2017-10369","Year":"2017"},"notes":[{"CveYear":"2017","CveId":"10369","Ordinal":"1","NoteData":"Vulnerability in the Oracle Virtual Directory component of Oracle Fusion Middleware (subcomponent: Virtual Directory Server). Supported versions that are affected are 11.1.1.7.0 and 11.1.1.9.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Virtual Directory. Successful attacks of this vulnerability can result in takeover of Oracle Virtual Directory. CVSS 3.0 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","Type":"Description","Title":"CVE-2017-10369"},{"CveYear":"2017","CveId":"10369","Ordinal":"2","NoteData":"2017-10-19","Type":"Other","Title":"Published"},{"CveYear":"2017","CveId":"10369","Ordinal":"3","NoteData":"2017-10-20","Type":"Other","Title":"Modified"}]}}}