CVE-2017-3347: High severity Oracle Marketing vulnerability

Published Apr 25, 2017

Updated

Vulnerability in the Oracle Marketing component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Marketing. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Marketing accessible data as well as unauthorized read access to a subset of Oracle Marketing accessible data. CVSS 3.0 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N).

Affected Software

7 affected components

Oracle Marketing=12.1.1

Oracle Marketing=12.1.2

Oracle Marketing=12.1.3

Oracle Marketing=12.2.3

Oracle Marketing=12.2.4

Oracle Marketing=12.2.5

Oracle Marketing=12.2.6

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Compensating control
Restrict network access to the Oracle Marketing HTTP interface so unauthenticated network attackers cannot reach it (mitigation for the AV:N vector).
Operational
Because successful exploitation requires human interaction, ensure any required user interaction prompts/workflows for Oracle Marketing are protected from tampering (e.g., prevent unauthorized users from interacting with the Oracle Marketing UI during exposure window).

Event History

Apr 25, 2017

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

DescriptionWeakness

Data Sourced

via NVD·07:59 PM

RemedyDescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of CVE-2017-3347?

The severity of CVE-2017-3347 is considered critical due to its easily exploitable nature.

How do I fix CVE-2017-3347?

To fix CVE-2017-3347, apply the latest security patches provided by Oracle for the affected versions.

Who is affected by CVE-2017-3347?

CVE-2017-3347 affects users of Oracle Marketing component in Oracle E-Business Suite versions 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, and 12.2.6.

What types of attacks can CVE-2017-3347 lead to?

CVE-2017-3347 can potentially allow unauthorized remote access and exploitation by unauthenticated attackers.

When was CVE-2017-3347 disclosed?

CVE-2017-3347 was disclosed in April 2017 during Oracle's Critical Patch Update.