Vulnerability Details : CVE-2017-3597
Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI). Supported versions that are affected are 11.1.1.8.0, 12.2.1.0.0, 12.2.1.1.0 and 12.2.1.2.0. Easily "exploitable" vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Sites accessible data. CVSS 3.0 Base Score 5.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N).
Vulnerability category: Bypass
Exploit prediction scoring system (EPSS) score for CVE-2017-3597
Probability of exploitation activity in the next 30 days: 0.09%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 38 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2017-3597
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
6.3
|
MEDIUM | AV:N/AC:M/Au:S/C:C/I:N/A:N |
6.8
|
6.9
|
NIST |
5.7
|
MEDIUM | CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N |
2.1
|
3.6
|
NIST |
References for CVE-2017-3597
-
http://www.securitytracker.com/id/1038291
Oracle Fusion Middleware Flaws Let Remote Users Access and Modify Data and Deny Service and Let Remote Authenticated Users Gain Elevated Privileges - SecurityTracker
-
http://www.securityfocus.com/bid/97904
Oracle WebCenter Sites CVE-2017-3597 Remote Security VulnerabilityThird Party Advisory;VDB Entry
-
http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html
Oracle Critical Patch Update - April 2017Patch;Vendor Advisory
Products affected by CVE-2017-3597
- cpe:2.3:a:oracle:webcenter_sites:11.1.1.8.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:webcenter_sites:12.2.1.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:webcenter_sites:12.2.1.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:webcenter_sites:12.2.1.1.0:*:*:*:*:*:*:*