CVE-2017-3477: Medium severity Oracle FLEXCUBE Private Banking vulnerability

Published Apr 24, 2017

Updated

Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Miscellaneous). Supported versions that are affected are 12.0.0 and 12.1.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Private Banking. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle FLEXCUBE Private Banking accessible data as well as unauthorized read access to a subset of Oracle FLEXCUBE Private Banking accessible data. CVSS 3.0 Base Score 4.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N).

Affected Software

2 affected components

Oracle FLEXCUBE Private Banking=12.0.0

Oracle FLEXCUBE Private Banking=12.1.0

Event History

Apr 24, 2017

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

DescriptionWeakness

Data Sourced

via NVD·07:59 PM

RemedyDescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of CVE-2017-3477?

The severity of CVE-2017-3477 is classified as a low risk vulnerability.

How do I fix CVE-2017-3477?

To fix CVE-2017-3477, you should upgrade to the latest version of Oracle FLEXCUBE Private Banking beyond 12.1.0.

Which versions are affected by CVE-2017-3477?

CVE-2017-3477 affects Oracle FLEXCUBE Private Banking versions 12.0.0 and 12.1.0.

Who can exploit CVE-2017-3477?

A low privileged attacker with network access via HTTP can exploit CVE-2017-3477.

What component of Oracle is impacted by CVE-2017-3477?

CVE-2017-3477 impacts the Oracle FLEXCUBE Private Banking component within Oracle Financial Services Applications.