CVE-2017-3535: Medium severity Oracle FLEXCUBE Universal Banking vulnerability
Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent: Infrastructure). Supported versions that are affected are 11.3.0, 11.4.0, 12.0.1, 12.0.2 and 12.0.3. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle FLEXCUBE Universal Banking. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle FLEXCUBE Universal Banking, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle FLEXCUBE Universal Banking accessible data. CVSS 3.0 Base Score 4.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-3535?
CVE-2017-3535 is rated as an easily exploitable vulnerability that allows unauthenticated attackers to gain unauthorized access.
Which versions of Oracle FLEXCUBE Universal Banking are affected by CVE-2017-3535?
The affected versions include 11.3.0, 11.4.0, 12.0.1, 12.0.2, and 12.0.3.
How do I fix CVE-2017-3535?
To fix CVE-2017-3535, apply the latest security patches provided by Oracle for the affected versions.
What could be the impact of exploiting CVE-2017-3535?
Exploiting CVE-2017-3535 could potentially allow attackers to compromise the integrity and confidentiality of the Oracle FLEXCUBE Universal Banking system.
Is CVE-2017-3535 still a threat if I have the latest version of Oracle FLEXCUBE Universal Banking?
CVE-2017-3535 does not affect systems that are updated to versions beyond the ones specified, but it is crucial to regularly apply patches.