Login Sign Up

CVE-2017-10329

9.1 CRITICAL

📋 TL;DR

This vulnerability in Oracle Global Order Promising allows unauthenticated attackers with network access via HTTP to compromise the system. Attackers can create, delete, or modify critical data, and access sensitive information without authorization. Affected versions include Oracle E-Business Suite 12.1.1 through 12.2.7.

💻 Affected Systems

Products:
  • Oracle E-Business Suite
Versions: 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7
Operating Systems: Any OS running Oracle E-Business Suite
Default Config Vulnerable: ⚠️ Yes
Notes: Specifically affects the Global Order Promising component, Reschedule Sales Orders subcomponent. All supported versions in the specified ranges are vulnerable.

📦 What is this software?

Global Order Promising by Oracle

View all CVEs affecting Global Order Promising →

Global Order Promising by Oracle

View all CVEs affecting Global Order Promising →

Global Order Promising by Oracle

View all CVEs affecting Global Order Promising →

Global Order Promising by Oracle

View all CVEs affecting Global Order Promising →

Global Order Promising by Oracle

View all CVEs affecting Global Order Promising →

Global Order Promising by Oracle

View all CVEs affecting Global Order Promising →

Global Order Promising by Oracle

View all CVEs affecting Global Order Promising →

Global Order Promising by Oracle

View all CVEs affecting Global Order Promising →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete compromise of Oracle Global Order Promising data including unauthorized creation, deletion, modification of all accessible data, and exposure of all sensitive information.

🟠

Likely Case

Unauthorized access to critical business data, potential manipulation of sales orders and promising data, leading to business disruption and data integrity issues.

🟢

If Mitigated

Limited impact if proper network segmentation and access controls prevent unauthenticated external access to vulnerable components.

🌐 Internet-Facing: HIGH - Unauthenticated network access via HTTP with no user interaction required makes internet-facing instances extremely vulnerable.
🏢 Internal Only: HIGH - Even internal instances are vulnerable to any network-connected attacker within the environment due to unauthenticated access requirement.

🎯 Exploit Status

Public PoC: ✅ No
Weaponized: UNKNOWN
Unauthenticated Exploit: ⚠️ Yes
Complexity: LOW

CVSS indicates easily exploitable (AC:L) with no authentication required (PR:N) and no user interaction (UI:N), suggesting simple exploitation.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Apply Oracle Critical Patch Update October 2017 or later

Vendor Advisory: http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

Restart Required: Yes

Instructions:

1. Download October 2017 Critical Patch Update from Oracle Support. 2. Apply patch to affected Oracle E-Business Suite instances. 3. Restart application services. 4. Test functionality of Global Order Promising component.

🔧 Temporary Workarounds

Network Access Restriction

linux

Restrict network access to Oracle E-Business Suite instances to only trusted IP addresses and networks

Use firewall rules to limit access: iptables -A INPUT -p tcp --dport <ebs-port> -s <trusted-ip> -j ACCEPT
iptables -A INPUT -p tcp --dport <ebs-port> -j DROP

Application Firewall Rules

all

Implement web application firewall rules to block suspicious requests to Reschedule Sales Orders endpoints

Configure WAF to block unauthenticated requests to /OA_HTML/* or similar Global Order Promising paths

🧯 If You Can't Patch

  • Isolate Oracle E-Business Suite instances in a separate network segment with strict access controls
  • Implement additional authentication layer (reverse proxy with authentication) in front of vulnerable endpoints

🔍 How to Verify

Check if Vulnerable:

Check Oracle E-Business Suite version and patch level, verify if October 2017 CPU has been applied

Check Version:

Check application version: For 12.1.x: SELECT RELEASE_NAME FROM FND_PRODUCT_GROUPS; For 12.2.x: adop version

Verify Fix Applied:

Verify patch application through Oracle OPatch utility: opatch lsinventory | grep -i 'CPUOct2017'

📡 Detection & Monitoring

Log Indicators:

  • Unauthenticated access attempts to Reschedule Sales Orders endpoints
  • Unusual data modification patterns in Global Order Promising logs
  • HTTP requests to /OA_HTML/* paths without session cookies

Network Indicators:

  • Unusual HTTP traffic patterns to Oracle E-Business Suite on standard ports (8000, 443)
  • Requests to known vulnerable endpoints without authentication headers

SIEM Query:

source="oracle-ebs-logs" AND (uri_path="/OA_HTML/*" OR component="Global Order Promising") AND (user="-" OR auth_status="failed")

📊 Metadata

CVE ID: CVE-2017-10329
CVSS v3 Score: 9.1 (CRITICAL)
CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Published: October 19, 2017
Last Updated: April 20, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON