CVE-2017-3473: Medium severity Oracle FLEXCUBE Private Banking vulnerability

Published Apr 24, 2017

Updated

Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Miscellaneous). Supported versions that are affected are 2.0.0, 2.0.1, 2.2.0.1 and 12.0.1. Easily "exploitable" vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Private Banking. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle FLEXCUBE Private Banking accessible data. CVSS 3.0 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).

Affected Software

4 affected components

Oracle FLEXCUBE Private Banking=2.0.0

Oracle FLEXCUBE Private Banking=2.0.1

Oracle FLEXCUBE Private Banking=2.2.0.1

Oracle FLEXCUBE Private Banking=12.0.1

Event History

Apr 24, 2017

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

DescriptionWeakness

Data Sourced

via NVD·07:59 PM

RemedyDescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of CVE-2017-3473?

CVE-2017-3473 is considered to be an easily exploitable vulnerability.

How do I fix CVE-2017-3473?

To fix CVE-2017-3473, users should apply the latest patches provided by Oracle for the affected versions.

What versions are affected by CVE-2017-3473?

CVE-2017-3473 affects Oracle FLEXCUBE Private Banking versions 2.0.0, 2.0.1, 2.2.0.1, and 12.0.1.

Who can exploit CVE-2017-3473?

CVE-2017-3473 can be exploited by low privileged attackers with network access.

What component of Oracle Financial Services Applications does CVE-2017-3473 affect?

CVE-2017-3473 affects the Oracle FLEXCUBE Private Banking component.