CVE-2017-3436: High severity Oracle One-to-One Fulfillment vulnerability

Published Jan 27, 2017

Updated

Vulnerability in the Oracle One-to-One Fulfillment component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle One-to-One Fulfillment. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle One-to-One Fulfillment, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle One-to-One Fulfillment accessible data as well as unauthorized update, insert or delete access to some of Oracle One-to-One Fulfillment accessible data. CVSS v3.0 Base Score 8.2 (Confidentiality and Integrity impacts).

Affected Software

7 affected components

Oracle One-to-One Fulfillment=12.1.1

Oracle One-to-One Fulfillment=12.1.2

Oracle One-to-One Fulfillment=12.1.3

Oracle One-to-One Fulfillment=12.2.3

Oracle One-to-One Fulfillment=12.2.4

Oracle One-to-One Fulfillment=12.2.5

Oracle One-to-One Fulfillment=12.2.6

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Oracle E-Business Suite - Oracle One-to-One Fulfillment (User Interface) to a version that resolves this vulnerability.
Fixed in 12.2.6

Event History

Jan 27, 2017

CVE Published

via MITRE·10:01 PM

Data Sourced

via MITRE·10:01 PM

DescriptionWeakness

Data Sourced

via NVD·10:59 PM

RemedyDescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of CVE-2017-3436?

CVE-2017-3436 is considered easily exploitable, allowing unauthenticated attackers to compromise the affected systems.

How do I fix CVE-2017-3436?

To remediate CVE-2017-3436, you should apply the latest security patches provided by Oracle for the affected versions.

What versions of Oracle One-to-One Fulfillment are affected by CVE-2017-3436?

CVE-2017-3436 affects Oracle One-to-One Fulfillment versions 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, and 12.2.6.

Is CVE-2017-3436 a network vulnerability?

Yes, CVE-2017-3436 is a network vulnerability that can be exploited remotely by an attacker.

Who is at risk from CVE-2017-3436?

Organizations using affected versions of Oracle E-Business Suite's Oracle One-to-One Fulfillment component are at risk from CVE-2017-3436.