Vulnerability record · CVE-2017-10267 · published 14 November 2017

CVE-2017-10267: Oracle tuxedo information exposure vulnerability

Oracle · Tuxedo

Vulnerability in the Oracle Tuxedo component of Oracle Fusion Middleware (subcomponent: Core). Supported versions that are affected are 11.1.1, 12.1.1, 12.1.3 and 12.2.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via Jolt to compromise Oracle Tuxedo. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Tuxedo accessible data. CVSS 3.0 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

7.5 CVSS 3.0 High EPSS 1.5% · top 27.2% CWE-200 · Information exposure

7.5CVSS 3.0 base score, v2 5.0

1.5%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

4References

17 Jun 2026Last modified by NVD

Description

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Tuxedo Oracle

References

Link	Tags
http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-10269-4021872.html	PatchVendor Advisory
http://www.securityfocus.com/bid/101875	Third Party AdvisoryVDB Entry
http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-10269-4021872.html	PatchVendor Advisory
http://www.securityfocus.com/bid/101875	Third Party AdvisoryVDB Entry

Track CVE-2017-10267 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2017-10269Oracle tuxedo vulnerabilityVulnerability in the Oracle Tuxedo component of Oracle Fusion Middleware (subcomponent: Core). Supported versions that are affected are 11.1.1, 12.1.…EPSS 2.1%14 Nov 2017 9.9CVE-2017-10272Oracle tuxedo vulnerabilityVulnerability in the Oracle Tuxedo component of Oracle Fusion Middleware (subcomponent: Core). Supported versions that are affected are 11.1.1, 12.1.…EPSS 1.2%14 Nov 2017 9.8CVE-2022-23305Log4j 1.x JDBCAppender SQL injection via logged inputThe JDBCAppender in Log4j 1.2.x builds SQL statements from configuration parameters and PatternLayout converters, so logged values such as the %m mes…EPSS 67%analysed18 Jan 2022 8.8CVE-2022-23302Apache Log4j 1.x JMSSink JNDI deserialization remote code executionJMSSink in all versions of Log4j 1.x deserializes untrusted data when an attacker can write to the Log4j configuration or when the configuration refe…EPSS 64%analysed18 Jan 2022 8.8CVE-2022-23307Apache Chainsaw and Log4j 1.2.x Deserialization of Untrusted DataCVE-2022-23307 is a deserialization of untrusted data flaw (CWE-502) that was originally identified in Apache Chainsaw as CVE-2020-9493. The same iss…EPSS 54%analysed18 Jan 2022 8.6CVE-2018-3007Oracle tuxedo vulnerabilityVulnerability in the Oracle Tuxedo component of Oracle Fusion Middleware (subcomponent: Core). Supported versions that are affected are 12.1.1, 12.1.…EPSS 2.7%18 Jul 2018 7.5CVE-2021-4104Apache Log4j 1.2 JMSAppender deserialization leads to remote code executionJMSAppender in Apache Log4j 1.2 deserializes untrusted data when an attacker can write to the Log4j configuration, allowing TopicBindingName and Topi…EPSS 81%analysed14 Dec 2021 7.5CVE-2019-0227Apache Axis 1.4 SSRF via AdminService (expired domain)Apache Axis 1.4, last released in 2006, contains a server-side request forgery flaw in its AdminService. The service can be induced to fetch a remote…EPSS 92%analysed1 May 2019

Source: NIST National Vulnerability Database (record CVE-2017-10267), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.