CVE-2017-3541: High severity Oracle WebCenter Sites vulnerability
Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Server). Supported versions that are affected are 11.1.1.8.0, 12.2.1.0.0, 12.2.1.1.0 and 12.2.1.2.0. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Sites accessible data as well as unauthorized update, insert or delete access to some of Oracle WebCenter Sites accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Oracle WebCenter Sites (Oracle Fusion Middleware) Serverto a version that resolves this vulnerability.Fixed in 11.1.1.8.0 - Upgrade
Upgrade
Oracle WebCenter Sites (Oracle Fusion Middleware) Serverto a version that resolves this vulnerability.Fixed in 12.2.1.0.0 - Upgrade
Upgrade
Oracle WebCenter Sites (Oracle Fusion Middleware) Serverto a version that resolves this vulnerability.Fixed in 12.2.1.1.0 - Upgrade
Upgrade
Oracle WebCenter Sites (Oracle Fusion Middleware) Serverto a version that resolves this vulnerability.Fixed in 12.2.1.2.0 - Compensating control
Restrict network access to the Oracle WebCenter Sites Server over HTTP so that unauthenticated remote attackers cannot reach it (since exploitation is via HTTP with network access and no authentication required).
Event History
Frequently Asked Questions
What is the severity of CVE-2017-3541?
CVE-2017-3541 is considered to be easily exploitable and has the potential to allow unauthorized remote access.
Which Oracle WebCenter Sites versions are affected by CVE-2017-3541?
CVE-2017-3541 affects Oracle WebCenter Sites versions 11.1.1.8.0, 12.2.1.0.0, 12.2.1.1.0, and 12.2.1.2.0.
How do I fix CVE-2017-3541?
To fix CVE-2017-3541, it is recommended to apply the latest Oracle security patches or updates provided for affected versions.
Can CVE-2017-3541 be exploited without authentication?
Yes, CVE-2017-3541 can be exploited by unauthenticated attackers with network access via HTTP.
Is there a workaround for CVE-2017-3541?
While no specific workaround is stated, securing network access and applying patches are the recommended measures against CVE-2017-3541.