CVE-2017-3622

high-risk

Published 2017-04-24

Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Common Desktop Environment (CDE)). The supported version that is affected is 10. Easily "exploitable" vulnerability allows low privileged attacker with logon to the infrastructure where Solaris executes to compromise Solaris. Successful attacks of this vulnerability can result in takeover of Solaris. Note: CVE-2017-3622 is assigned for the "Extremeparr". CVSS 3.0 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Do I need to act?

19.6% chance of exploitation in next 30 days

EPSS score — higher than 80% of all CVEs

Not on CISA KEV list

No confirmed active exploitation reported to CISA

1 public exploit available

45479

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 7.8/10 High

LOCAL / LOW complexity

Affected Products (1)

Solaris

Affected Vendors

Oracle

References (8)

Patch http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html

Third Party Advisory http://www.securityfocus.com/bid/97774

http://www.securitytracker.com/id/1038292

https://www.exploit-db.com/exploits/45479/

Patch http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html

Third Party Advisory http://www.securityfocus.com/bid/97774

http://www.securitytracker.com/id/1038292

https://www.exploit-db.com/exploits/45479/

/ 100

high-risk

Severity 24/34 · High

Exploitability 21/34 · High

Exposure 5/34 · Minimal