CVE-2017-3597: Medium severity Oracle WebCenter Sites vulnerability

Published Apr 24, 2017

Updated

Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI). Supported versions that are affected are 11.1.1.8.0, 12.2.1.0.0, 12.2.1.1.0 and 12.2.1.2.0. Easily "exploitable" vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Sites accessible data. CVSS 3.0 Base Score 5.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N).

Affected Software

4 affected components

Oracle WebCenter Sites=11.1.1.8.0

Oracle WebCenter Sites=12.2.1.0.0

Oracle WebCenter Sites=12.2.1.1.0

Oracle WebCenter Sites=12.2.1.2.0

Event History

Apr 24, 2017

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

DescriptionWeakness

Data Sourced

via NVD·07:59 PM

RemedyDescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of CVE-2017-3597?

CVE-2017-3597 is classified as an easily exploitable vulnerability with low privilege requirements.

How do I fix CVE-2017-3597?

To fix CVE-2017-3597, apply the latest security patches provided by Oracle for the affected versions of WebCenter Sites.

Which versions of Oracle WebCenter Sites are affected by CVE-2017-3597?

CVE-2017-3597 affects Oracle WebCenter Sites versions 11.1.1.8.0, 12.2.1.0.0, 12.2.1.1.0, and 12.2.1.2.0.

What component is impacted by CVE-2017-3597?

CVE-2017-3597 impacts the Advanced UI component of Oracle WebCenter Sites within Oracle Fusion Middleware.

Can CVE-2017-3597 be exploited remotely?

Yes, CVE-2017-3597 can be exploited by an attacker with network access via HTTP.