Vulnerability Details : CVE-2017-3283
Vulnerability in the Oracle Partner Management component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Partner Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Partner Management, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Partner Management accessible data. CVSS v3.0 Base Score 4.7 (Integrity impacts).
Vulnerability category: Input validation
Exploit prediction scoring system (EPSS) score for CVE-2017-3283
Probability of exploitation activity in the next 30 days: 0.17%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 53 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2017-3283
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
4.3
|
MEDIUM | AV:N/AC:M/Au:N/C:N/I:P/A:N |
8.6
|
2.9
|
NIST |
4.7
|
MEDIUM | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N |
2.8
|
1.4
|
NIST |
CWE ids for CVE-2017-3283
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by: nvd@nist.gov (Primary)
References for CVE-2017-3283
-
http://www.oracle.com/technetwork/security-advisory/cpujan2017-2881727.html
Oracle Critical Patch Update - January 2017Patch;Vendor Advisory
-
http://www.securityfocus.com/bid/95587
Oracle E-Business Suite CVE-2017-3283 Remote Security Vulnerability
-
http://www.securitytracker.com/id/1037639
Oracle E-Business Suite Multiple Flaws Let Remote and Local Users Access and Modify Data on the Target System - SecurityTracker
Products affected by CVE-2017-3283
- cpe:2.3:a:oracle:partner_management:12.2.5:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:partner_management:12.2.6:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:partner_management:12.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:partner_management:12.2.4:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:partner_management:12.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:partner_management:12.2.3:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:partner_management:12.1.2:*:*:*:*:*:*:*