CVE-2017-3557: XSS

Published Apr 24, 2017

Updated

Vulnerability in the Oracle One-to-One Fulfillment component of Oracle E-Business Suite (subcomponent: Print Server). Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle One-to-One Fulfillment. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle One-to-One Fulfillment, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle One-to-One Fulfillment accessible data as well as unauthorized update, insert or delete access to some of Oracle One-to-One Fulfillment accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N).

Affected Software

5 affected components

Oracle One-to-One Fulfillment=12.1.3

Oracle One-to-One Fulfillment=12.2.3

Oracle One-to-One Fulfillment=12.2.4

Oracle One-to-One Fulfillment=12.2.5

Oracle One-to-One Fulfillment=12.2.6

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Compensating control
Because Oracle One-to-One Fulfillment vulnerability (HTTP, unauthenticated network access) can compromise data and allow unauthorized updates/inserts/deletes, restrict network access to the Oracle E-Business Suite Oracle One-to-One Fulfillment Print Server so it is not reachable from untrusted networks over HTTP.

Event History

Apr 24, 2017

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

DescriptionWeakness

Data Sourced

via NVD·07:59 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2017-3557?

CVE-2017-3557 is considered easily exploitable, allowing unauthenticated attackers with network access via HTTP.

How do I fix CVE-2017-3557?

To fix CVE-2017-3557, it is recommended to install the latest security patches provided by Oracle for the affected versions.

What versions of Oracle One-to-One Fulfillment are impacted by CVE-2017-3557?

CVE-2017-3557 affects Oracle One-to-One Fulfillment versions 12.1.3, 12.2.3, 12.2.4, 12.2.5, and 12.2.6.

Is CVE-2017-3557 remotely exploitable?

Yes, CVE-2017-3557 can be remotely exploited by attackers with network access via HTTP.

What type of component is affected by CVE-2017-3557?

CVE-2017-3557 affects the Print Server component within the Oracle One-to-One Fulfillment of the Oracle E-Business Suite.