CVE-2017-3540: High severity Oracle WebCenter Sites vulnerability

Published Apr 24, 2017

Updated

Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Server). Supported versions that are affected are 11.1.1.8.0, 12.2.1.0.0, 12.2.1.1.0 and 12.2.1.2.0. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle WebCenter Sites as well as unauthorized update, insert or delete access to some of Oracle WebCenter Sites accessible data and unauthorized read access to a subset of Oracle WebCenter Sites accessible data. CVSS 3.0 Base Score 8.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H).

Affected Software

4 affected components

Oracle WebCenter Sites=11.1.1.8.0

Oracle WebCenter Sites=12.2.1.0.0

Oracle WebCenter Sites=12.2.1.1.0

Oracle WebCenter Sites=12.2.1.2.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Compensating control
Since an unauthenticated attacker with network access via HTTP can exploit the issue, restrict HTTP access to Oracle WebCenter Sites/Oracle Fusion Middleware Server components to trusted networks/clients only (e.g., via firewall/ACL/WAF).

Event History

Apr 24, 2017

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

DescriptionWeakness

Data Sourced

via NVD·07:59 PM

RemedyDescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of CVE-2017-3540?

CVE-2017-3540 is considered a high-severity vulnerability that allows unauthenticated attackers to exploit the system.

How do I fix CVE-2017-3540?

To fix CVE-2017-3540, you should apply the latest patches provided by Oracle for the affected versions.

Which versions of Oracle WebCenter Sites are affected by CVE-2017-3540?

CVE-2017-3540 affects Oracle WebCenter Sites versions 11.1.1.8.0, 12.2.1.0.0, 12.2.1.1.0, and 12.2.1.2.0.

What types of attacks can exploit CVE-2017-3540?

CVE-2017-3540 can be exploited by unauthenticated attackers with network access via HTTP.

Is there a temporary workaround for CVE-2017-3540?

There are no documented temporary workarounds for CVE-2017-3540; applying the patch is recommended.