CVE-2017-3425: High severity Oracle One-to-One Fulfillment vulnerability
Vulnerability in the Oracle One-to-One Fulfillment component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle One-to-One Fulfillment. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle One-to-One Fulfillment, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle One-to-One Fulfillment accessible data as well as unauthorized update, insert or delete access to some of Oracle One-to-One Fulfillment accessible data. CVSS v3.0 Base Score 8.2 (Confidentiality and Integrity impacts).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-3425?
CVE-2017-3425 is classified as a high severity vulnerability due to its potential for exploitation by unauthenticated attackers.
How do I fix CVE-2017-3425?
To fix CVE-2017-3425, apply the relevant security patches provided by Oracle for the affected versions of the One-to-One Fulfillment component.
Which versions are affected by CVE-2017-3425?
CVE-2017-3425 affects Oracle One-to-One Fulfillment versions 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, and 12.2.6.
What type of vulnerability is CVE-2017-3425?
CVE-2017-3425 is an easily exploitable vulnerability that allows an unauthenticated attacker to perform actions on the system.
Can CVE-2017-3425 be exploited remotely?
Yes, CVE-2017-3425 can be exploited remotely without requiring authentication.