CVE-2017-3598: Low severity Oracle WebCenter Sites vulnerability

Published Apr 24, 2017

Updated

Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI). Supported versions that are affected are 11.1.1.8.0, 12.2.1.0.0, 12.2.1.1.0 and 12.2.1.2.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle WebCenter Sites accessible data. CVSS 3.0 Base Score 3.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N).

Affected Software

4 affected components

Oracle WebCenter Sites=11.1.1.8.0

Oracle WebCenter Sites=12.2.1.0.0

Oracle WebCenter Sites=12.2.1.1.0

Oracle WebCenter Sites=12.2.1.2.0

Event History

Apr 24, 2017

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

DescriptionWeakness

Data Sourced

via NVD·07:59 PM

RemedyDescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of CVE-2017-3598?

CVE-2017-3598 is considered a low severity vulnerability that can be exploited by low privileged attackers.

How do I fix CVE-2017-3598?

To fix CVE-2017-3598, apply the latest security updates provided by Oracle for affected versions of WebCenter Sites.

Who is affected by CVE-2017-3598?

CVE-2017-3598 affects users running Oracle WebCenter Sites versions 11.1.1.8.0, 12.2.1.0.0, 12.2.1.1.0, and 12.2.1.2.0.

What impact does CVE-2017-3598 have on systems?

CVE-2017-3598 allows low privileged attackers to exploit the vulnerability over HTTP, potentially leading to unauthorized actions.

When was CVE-2017-3598 disclosed?

CVE-2017-3598 was disclosed in April 2017 as part of Oracle's Critical Patch Update.