Oracle Hospitality WebSuite8 Cloud Service 8.9.6/8.10.x access control

Summaryinfo

A vulnerability was found in Oracle Hospitality WebSuite8 Cloud Service 8.9.6/8.10.x. It has been rated as critical. This impacts an unknown function. The manipulation leads to access control. This vulnerability is listed as CVE-2017-10064. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability was found in Oracle Hospitality WebSuite8 Cloud Service 8.9.6/8.10.x (Hospitality Software). It has been rated as critical. This issue affects an unknown function. The manipulation with an unknown input leads to a access control vulnerability. Using CWE to declare the problem leads to CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. Impacted is confidentiality, and integrity. The summary by CVE is:

Vulnerability in the Hospitality WebSuite8 Cloud Service component of Oracle Hospitality Applications (subcomponent: General). Supported versions that are affected are 8.9.6 and 8.10.x. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Hospitality WebSuite8 Cloud Service. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Hospitality WebSuite8 Cloud Service, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Hospitality WebSuite8 Cloud Service accessible data as well as unauthorized read access to a subset of Hospitality WebSuite8 Cloud Service accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).

The bug was discovered 07/18/2017. The weakness was presented 08/08/2017 with Oracle (Website). The advisory is shared at oracle.com. The identification of this vulnerability is CVE-2017-10064 since 06/21/2017. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 01/07/2021). MITRE ATT&CK project uses the attack technique T1068 for this issue.

The vulnerability was handled as a non-public zero-day exploit for at least 20 days. During that time the estimated underground price was around $5k-$25k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at SecurityFocus (BID 100229†). See VDB-74371, VDB-89670, VDB-96591 and VDB-99569 for similar entries. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Hospitality Software

Vendor

• Oracle

Name

• Hospitality WebSuite8 Cloud Service

Version

• 8.9.6
• 8.10.x

License

• commercial

Website

• Vendor: https://www.oracle.com

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion