CVE-2017-3311: Medium severity Oracle Application Testing Suite vulnerability

Published Jan 27, 2017

Updated

Vulnerability in the Application Testing Suite component of Oracle Enterprise Manager Grid Control (subcomponent: Test Manager for Web Apps). Supported versions that are affected are 12.5.0.3, 12.5.0.2 and 12.4.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Application Testing Suite. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Application Testing Suite accessible data. CVSS v3.0 Base Score 5.3 (Integrity impacts).

Affected Software

3 affected components

Oracle Application Testing Suite=12.4.0.2

Oracle Application Testing Suite=12.5.0.2

Oracle Application Testing Suite=12.5.0.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Oracle Enterprise Manager Grid Control (Test Manager for Web Apps) / Application Testing Suite to a version that resolves this vulnerability.
Fixed in 12.5.0.3
Upgrade
Upgrade Oracle Enterprise Manager Grid Control (Test Manager for Web Apps) / Application Testing Suite to a version that resolves this vulnerability.
Fixed in 12.5.0.2
Upgrade
Upgrade Oracle Enterprise Manager Grid Control (Test Manager for Web Apps) / Application Testing Suite to a version that resolves this vulnerability.
Fixed in 12.4.0.2

Event History

Jan 27, 2017

CVE Published

via MITRE·10:01 PM

Data Sourced

via MITRE·10:01 PM

DescriptionWeakness

Data Sourced

via NVD·10:59 PM

RemedyDescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of CVE-2017-3311?

CVE-2017-3311 is considered to be easily exploitable, allowing unauthorized access to affected Oracle Application Testing Suite versions.

How do I fix CVE-2017-3311?

To mitigate CVE-2017-3311, upgrade to a fixed version of Oracle Application Testing Suite provided by Oracle.

Which versions of Oracle Application Testing Suite are affected by CVE-2017-3311?

CVE-2017-3311 affects Oracle Application Testing Suite versions 12.4.0.2, 12.5.0.2, and 12.5.0.3.

Can CVE-2017-3311 be exploited remotely?

Yes, CVE-2017-3311 can be exploited by unauthenticated attackers with network access.

What component of Oracle is vulnerable in CVE-2017-3311?

CVE-2017-3311 affects the Application Testing Suite component of Oracle Enterprise Manager Grid Control.