CVE-2017-3500: High severity Oracle Primavera Gateway vulnerability
Vulnerability in the Primavera Gateway component of Oracle Primavera Products Suite (subcomponent: Primavera Desktop Integration). Supported versions that are affected are 1.0, 1.1, 14.2, 15.1, 15.2, 16.1 and 16.2. Easily "exploitable" vulnerability allows high privileged attacker with network access via HTTP to compromise Primavera Gateway. While the vulnerability is in Primavera Gateway, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Primavera Gateway accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Primavera Gateway. CVSS 3.0 Base Score 8.7 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:H).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-3500?
CVE-2017-3500 has been classified as an easily exploitable vulnerability that can be targeted by a high privileged attacker with network access.
How can I fix CVE-2017-3500?
To mitigate CVE-2017-3500, Oracle recommends updating to the latest version of Primavera Gateway that resolves the vulnerability.
Which versions of Oracle Primavera Gateway are affected by CVE-2017-3500?
Affected versions of Oracle Primavera Gateway include 1.0, 1.1, 14.2, 15.1, 15.2, 16.1, and 16.2.
What components are involved in CVE-2017-3500?
CVE-2017-3500 affects the Primavera Gateway component within the Oracle Primavera Products Suite.
Who is at risk from CVE-2017-3500?
High privileged attackers with network access to vulnerable versions of Oracle Primavera Gateway are at risk of exploiting CVE-2017-3500.