CVE-2017-3556

Vulnerability in the Oracle Application Object Library component of Oracle E-Business Suite (subcomponent: File Management). Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Object Library. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Application Object Library accessible data. CVSS 3.0 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).

CVSS v3 5.3 MEDIUM
CVSS v2.0 5.0 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html	Vendor Advisory
http://www.securityfocus.com/bid/97785	Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1038299
https://erpscan.io/advisories/erpscan-17-025-auth-bypass-file-downloading-oracle-e-business-suite/

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:oracle:application_object_library:12.1.3:::::::*
	cpe:2.3:a:oracle:application_object_library:12.2.3:::::::*
	cpe:2.3:a:oracle:application_object_library:12.2.4:::::::*
	cpe:2.3:a:oracle:application_object_library:12.2.5:::::::*
	cpe:2.3:a:oracle:application_object_library:12.2.6:::::::*

History

No history.

Information

Published : 2017-04-24 19:59

Updated : 2023-12-10 12:01

NVD link : CVE-2017-3556

Mitre link : CVE-2017-3556

CVE.ORG link : CVE-2017-3556

JSON object : View

Products Affected

oracle

application_object_library

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

{"id": "CVE-2017-3556", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2017-04-24T19:59:04.643", "references": [{"url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html", "tags": ["Vendor Advisory"], "source": "secalert_us@oracle.com"}, {"url": "http://www.securityfocus.com/bid/97785", "tags": ["Third Party Advisory", "VDB Entry"], "source": "secalert_us@oracle.com"}, {"url": "http://www.securitytracker.com/id/1038299", "source": "secalert_us@oracle.com"}, {"url": "https://erpscan.io/advisories/erpscan-17-025-auth-bypass-file-downloading-oracle-e-business-suite/", "source": "secalert_us@oracle.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "Vulnerability in the Oracle Application Object Library component of Oracle E-Business Suite (subcomponent: File Management). Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Object Library. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Application Object Library accessible data. CVSS 3.0 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)."}, {"lang": "es", "value": "Vulnerabilidad en el componente Application Object Library de Oracle E-Business Suite (subcomponente: administraci\u00f3n de archivos). Las versiones compatibles que se ven afectadas son 12.1.3, 12.2.3, 12.2.4, 12.2.5 y 12.2.6. La vulnerabilidad de dif\u00edcil explotaci\u00f3n permite al atacante sin autenticar con acceso a la red por medio de HTTP comprometer a Application Object Library de Oracle. Los ataques con \u00e9xito de esta vulnerabilidad pueden resultar en un acceso de lectura no autorizado a un subconjunto de datos accesibles de Application Object Library de Oracle. CVSS 3.0 puntuaci\u00f3n base 3.7 (impactos de confidencialidad). Vector CVSS:(CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)."}], "lastModified": "2018-12-10T19:29:22.737", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:oracle:application_object_library:12.1.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F7A59435-A033-48BD-AC2A-140DCF6113DF"}, {"criteria": "cpe:2.3:a:oracle:application_object_library:12.2.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "73BD1423-F7EE-4B53-AE4B-DFA784F685C8"}, {"criteria": "cpe:2.3:a:oracle:application_object_library:12.2.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C95FED83-21C8-4035-BB1B-3C8A93D4645F"}, {"criteria": "cpe:2.3:a:oracle:application_object_library:12.2.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "411C3C4C-5513-4F7D-8D58-A39F21F43637"}, {"criteria": "cpe:2.3:a:oracle:application_object_library:12.2.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3118706C-CD62-4E5A-9846-F083ECA5B799"}], "operator": "OR"}]}], "sourceIdentifier": "secalert_us@oracle.com"}