CVE-2017-3434: High severity Oracle One-to-One Fulfillment vulnerability

Published Apr 25, 2017

Updated

Vulnerability in the Oracle One-to-One Fulfillment component of Oracle E-Business Suite (subcomponent: Audience workbench). Supported versions that are affected are 12.1.1, 12.1.2 and 12.1.3. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle One-to-One Fulfillment. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle One-to-One Fulfillment accessible data as well as unauthorized read access to a subset of Oracle One-to-One Fulfillment accessible data. CVSS 3.0 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N).

Affected Software

3 affected components

Oracle One-to-One Fulfillment=12.1.1

Oracle One-to-One Fulfillment=12.1.2

Oracle One-to-One Fulfillment=12.1.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Oracle E-Business Suite - Oracle One-to-One Fulfillment (Audience workbench) to a version that resolves this vulnerability.
Fixed in 12.1.1
Upgrade
Upgrade Oracle E-Business Suite - Oracle One-to-One Fulfillment (Audience workbench) to a version that resolves this vulnerability.
Fixed in 12.1.2
Upgrade
Upgrade Oracle E-Business Suite - Oracle One-to-One Fulfillment (Audience workbench) to a version that resolves this vulnerability.
Fixed in 12.1.3

Event History

Apr 25, 2017

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

DescriptionWeakness

Data Sourced

via NVD·07:59 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of CVE-2017-3434?

CVE-2017-3434 is classified as an easily exploitable vulnerability allowing unauthenticated attackers to compromise the Oracle One-to-One Fulfillment component.

How do I fix CVE-2017-3434?

To fix CVE-2017-3434, update your Oracle E-Business Suite to the latest patched version as recommended by Oracle.

Which versions are affected by CVE-2017-3434?

CVE-2017-3434 affects Oracle One-to-One Fulfillment versions 12.1.1, 12.1.2, and 12.1.3.

What component is impacted by CVE-2017-3434?

CVE-2017-3434 impacts the Audience workbench component of Oracle's One-to-One Fulfillment.

Can CVE-2017-3434 be exploited remotely?

Yes, CVE-2017-3434 can be exploited remotely via HTTP by unauthenticated attackers.