FKIE_CVE-2017-3347

Vulnerability from fkie_nvd - Published: 2017-04-25 19:59 - Updated: 2026-06-17 01:18
Severity
7.1 (High) - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N
Summary
Vulnerability in the Oracle Marketing component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Marketing. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Marketing accessible data as well as unauthorized read access to a subset of Oracle Marketing accessible data. CVSS 3.0 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N).
References
secalert_us@oracle.comhttp://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.htmlPatch, Vendor Advisory
secalert_us@oracle.comhttp://www.securityfocus.com/bid/98060
af854a3a-2127-422b-91ae-364da2661108http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.htmlPatch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/98060
Impacted products
Vendor Product Version
oracle marketing 12.1.1
oracle marketing 12.1.2
oracle marketing 12.1.3
oracle marketing 12.2.3
oracle marketing 12.2.4
oracle marketing 12.2.5
oracle marketing 12.2.6
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "Marketing",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "12.1.1"
            },
            {
              "status": "affected",
              "version": "12.1.2"
            },
            {
              "status": "affected",
              "version": "12.1.3"
            },
            {
              "status": "affected",
              "version": "12.2.3"
            },
            {
              "status": "affected",
              "version": "12.2.4"
            },
            {
              "status": "affected",
              "version": "12.2.5"
            },
            {
              "status": "affected",
              "version": "12.2.6"
            }
          ]
        }
      ],
      "source": "secalert_us@oracle.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oracle:marketing:12.1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "FE5E189E-FB41-4332-A037-3DDA98746371",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:marketing:12.1.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "5EC9AAD6-30EF-4F5B-9923-2619E75C66B4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:marketing:12.1.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "EDB00EEA-140F-4652-AF01-5FE522E5D1BE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:marketing:12.2.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "6CEB6C88-B08C-44B2-8330-57B5BD931A56",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:marketing:12.2.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "F8273378-896F-4EA3-884C-47B31422028C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:marketing:12.2.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "704D9437-039F-46F4-ACC4-C8C10C56E251",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:marketing:12.2.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "F8C98EA8-6D5A-40DF-8232-818C8BB2FB9B",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Vulnerability in the Oracle Marketing component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily \"exploitable\" vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Marketing. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Marketing accessible data as well as unauthorized read access to a subset of Oracle Marketing accessible data. CVSS 3.0 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N)."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad en el componente Oracle Marketing de Oracle E-Business Suite (subcomponente: interfaz de usuario). Las versiones afectadas son: 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 y 12.2.6. La vulnerabilidad, f\u00e1cilmente explotable, permite a atacantes no autenticados que tengan acceso a la red a trav\u00e9s de tr\u00e1fico HTTP comprometer dicho componente. Para que el ataque tenga \u00e9xito es necesaria la interacci\u00f3n de otra persona adem\u00e1s del atacante. La explotaci\u00f3n del fallo puede derivar en la creaci\u00f3n, eliminaci\u00f3n o modificaci\u00f3n de informaci\u00f3n sensible o el acceso a toda la informaci\u00f3n de Oracle Marketing, as\u00ed como la lectura de cierta informaci\u00f3n a la que tiene acceso el propio componente. CVSS 3.0 Base Score 7.1 (impacto en la confidencialidad y en la integridad). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N)."
    }
  ],
  "id": "CVE-2017-3347",
  "lastModified": "2026-06-17T01:18:04.843",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.8,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "LOW",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N",
          "version": "3.0"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 4.2,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2017-3347",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2024-10-07T15:44:15.757707Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2017-04-25T19:59:00.287",
  "references": [
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html"
    },
    {
      "source": "secalert_us@oracle.com",
      "url": "http://www.securityfocus.com/bid/98060"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/98060"
    }
  ],
  "sourceIdentifier": "secalert_us@oracle.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.