CVE-2017-3556: Infoleak

Published Apr 24, 2017

Updated

Vulnerability in the Oracle Application Object Library component of Oracle E-Business Suite (subcomponent: File Management). Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Object Library. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Application Object Library accessible data. CVSS 3.0 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).

Affected Software

5 affected components

Oracle Application Object Library=12.1.3

Oracle Application Object Library=12.2.3

Oracle Application Object Library=12.2.4

Oracle Application Object Library=12.2.5

Oracle Application Object Library=12.2.6

Event History

Apr 24, 2017

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

DescriptionWeakness

Data Sourced

via NVD·07:59 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2017-3556?

CVE-2017-3556 has a moderate severity rating, indicating it is difficult to exploit but poses a risk to Oracle E-Business Suite users.

How do I fix CVE-2017-3556?

To fix CVE-2017-3556, apply the latest security patch provided by Oracle for the affected versions of the Application Object Library.

What versions of Oracle E-Business Suite are affected by CVE-2017-3556?

Oracle E-Business Suite versions 12.1.3, 12.2.3, 12.2.4, 12.2.5, and 12.2.6 are affected by CVE-2017-3556.

Is CVE-2017-3556 exploitable remotely?

Yes, CVE-2017-3556 allows unauthenticated attackers to exploit the vulnerability remotely if they have network access.

What component of Oracle E-Business Suite is impacted by CVE-2017-3556?

CVE-2017-3556 impacts the File Management component of the Oracle Application Object Library.