CVE-2017-10214

HIGH

Oracle Retail Xstore <16.0 - Unauth RCE

Title source: llm
STIX 2.1

Description

Vulnerability in the Oracle Retail Xstore Point of Service component of Oracle Retail Applications (subcomponent: Xstore Office). Supported versions that are affected are 6.0.x, 6.5.x, 7.0.x, 7.1.x, 15.0.x and 16.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Xstore Point of Service. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Retail Xstore Point of Service accessible data as well as unauthorized update, insert or delete access to some of Oracle Retail Xstore Point of Service accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).

References (3)

Core 3
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/99733
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1038944

Scores

CVSS v3 8.2
EPSS 0.0159
EPSS Percentile 81.8%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

Status published
Products (28)
oracle/retail_xstore_point_of_service 6.0.10
oracle/retail_xstore_point_of_service 6.0.11
oracle/retail_xstore_point_of_service 6.5.4
oracle/retail_xstore_point_of_service 6.5.10
oracle/retail_xstore_point_of_service 6.5.11
oracle/retail_xstore_point_of_service 7.0
oracle/retail_xstore_point_of_service 7.0.1
oracle/retail_xstore_point_of_service 7.0.2
oracle/retail_xstore_point_of_service 7.0.3
oracle/retail_xstore_point_of_service 7.0.4
... and 18 more
Published Aug 08, 2017
Tracked Since Feb 18, 2026