Vulnerability Details : CVE-2017-3556
Vulnerability in the Oracle Application Object Library component of Oracle E-Business Suite (subcomponent: File Management). Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Object Library. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Application Object Library accessible data. CVSS 3.0 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).
Vulnerability category: Information leak
Products affected by CVE-2017-3556
- cpe:2.3:a:oracle:application_object_library:12.2.4:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:application_object_library:12.2.3:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:application_object_library:12.2.5:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:application_object_library:12.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:application_object_library:12.2.6:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2017-3556
0.18%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 55 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2017-3556
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:P/I:N/A:N |
10.0
|
2.9
|
NIST | |
5.3
|
MEDIUM | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
3.9
|
1.4
|
NIST |
CWE ids for CVE-2017-3556
-
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.Assigned by: nvd@nist.gov (Primary)
References for CVE-2017-3556
-
https://erpscan.io/advisories/erpscan-17-025-auth-bypass-file-downloading-oracle-e-business-suite/
[ERPSCAN-17-025] AUTH BYPASS For File Downloading - Oracle E-Business Suite
-
http://www.securityfocus.com/bid/97785
Oracle E-Business Suite CVE-2017-3556 Remote Security VulnerabilityThird Party Advisory;VDB Entry
-
http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html
Oracle Critical Patch Update - April 2017Vendor Advisory
-
http://www.securitytracker.com/id/1038299
Oracle E-Business Suite Multiple Flaws Let Remote Users Access and Modify Data and Cause Denial of Service Conditions on the Target System - SecurityTracker
Jump to