{"api_version":"1","generated_at":"2026-07-23T08:29:06+00:00","cve":"CVE-2017-10669","urls":{"html":"https://cve.report/CVE-2017-10669","api":"https://cve.report/api/cve/CVE-2017-10669.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2017-10669","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2017-10669"},"summary":{"title":"CVE-2017-10669","description":"Signature Wrapping exists in OSCI-Transport 1.2 as used in OSCI Transport Library 1.6.1 (Java) and OSCI Transport Library 1.6 (.NET). An attacker with access to unencrypted OSCI protocol messages must send crafted protocol messages with duplicate IDs.","state":"PUBLISHED","assigner":"mitre","published_at":"2017-06-30 12:29:00","updated_at":"2025-04-20 01:37:25"},"problem_types":["CWE-347","n/a"],"metrics":[{"version":"3.0","source":"nvd@nist.gov","type":"Primary","score":"6.5","severity":"MEDIUM","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","data":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"}},{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"6.4","severity":"","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:N","baseScore":6.4,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"http://seclists.org/fulldisclosure/2017/Jun/44","name":"http://seclists.org/fulldisclosure/2017/Jun/44","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"],"title":"Full Disclosure: SEC Consult SA-20170630-0 :: Multiple critical vulnerabilities in OSCI-Transport library 1.2 for German e-Government","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://blog.sec-consult.com/2017/06/german-e-government-details-vulnerabilities.html","name":"http://blog.sec-consult.com/2017/06/german-e-government-details-vulnerabilities.html","refsource":"nvd@nist.gov","tags":["Technical Description","Third Party Advisory"],"title":"404 - Page not found! - SEC Consult","mime":"text/html","httpstatus":"404","archivestatus":"403"},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-10669","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-10669","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2017","cve_id":"10669","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"xoev","cpe5":"osci_transport_library","cpe6":"1.6","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":".net","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"10669","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"xoev","cpe5":"osci_transport_library","cpe6":"1.6.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"java","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-05T17:41:55.517Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_refsource_MISC","x_transferred"],"url":"http://seclists.org/fulldisclosure/2017/Jun/44"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2017-06-30T00:00:00.000Z","descriptions":[{"lang":"en","value":"Signature Wrapping exists in OSCI-Transport 1.2 as used in OSCI Transport Library 1.6.1 (Java) and OSCI Transport Library 1.6 (.NET). An attacker with access to unencrypted OSCI protocol messages must send crafted protocol messages with duplicate IDs."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-06-30T11:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"tags":["x_refsource_MISC"],"url":"http://seclists.org/fulldisclosure/2017/Jun/44"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2017-10669","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Signature Wrapping exists in OSCI-Transport 1.2 as used in OSCI Transport Library 1.6.1 (Java) and OSCI Transport Library 1.6 (.NET). An attacker with access to unencrypted OSCI protocol messages must send crafted protocol messages with duplicate IDs."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"http://seclists.org/fulldisclosure/2017/Jun/44","refsource":"MISC","url":"http://seclists.org/fulldisclosure/2017/Jun/44"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2017-10669","datePublished":"2017-06-30T12:00:00.000Z","dateReserved":"2017-06-28T00:00:00.000Z","dateUpdated":"2024-08-05T17:41:55.517Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2017-06-30 12:29:00","lastModifiedDate":"2025-04-20 01:37:25","problem_types":["CWE-347","n/a"],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.5}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:N","baseScore":6.4,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10,"impactScore":4.9,"acInsufInfo":true,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:xoev:osci_transport_library:1.6:*:*:*:.net:*:*:*","matchCriteriaId":"BC7159A3-28E0-4AE2-A2A5-7B5F44D7305F"},{"vulnerable":true,"criteria":"cpe:2.3:a:xoev:osci_transport_library:1.6.1:*:*:*:java:*:*:*","matchCriteriaId":"7F00B66D-46D7-4D58-A1A0-7BA1AD5C0EEE"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2017","CveId":"10669","Ordinal":"1","Title":"CVE-2017-10669","CVE":"CVE-2017-10669","Year":"2017"},"notes":[{"CveYear":"2017","CveId":"10669","Ordinal":"1","NoteData":"Signature Wrapping exists in OSCI-Transport 1.2 as used in OSCI Transport Library 1.6.1 (Java) and OSCI Transport Library 1.6 (.NET). An attacker with access to unencrypted OSCI protocol messages must send crafted protocol messages with duplicate IDs.","Type":"Description","Title":"CVE-2017-10669"},{"CveYear":"2017","CveId":"10669","Ordinal":"2","NoteData":"2017-06-30","Type":"Other","Title":"Published"},{"CveYear":"2017","CveId":"10669","Ordinal":"3","NoteData":"2017-06-30","Type":"Other","Title":"Modified"}]}}}