High severity · published Apr 24, 2017
CVE-2017-3507
Vulnerability in the Oracle Service Bus component of Oracle Fusion Middleware (subcomponent: Web Console Design)
7.3
CVSS
1.7%
EPSS
No
On KEV
Description
Vulnerability in the Oracle Service Bus component of Oracle Fusion Middleware (subcomponent: Web Console Design). Supported versions that are affected are 12.1.3.0.0, 12.2.1.0.0, 12.2.1.1.0 and 12.2.1.2.0. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Service Bus. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Service Bus accessible data as well as unauthorized read access to a subset of Oracle Service Bus accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Service Bus. CVSS 3.0 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 77% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SB
Service Bus · Oracle
12.1.3.0.0; 12.2.1.0.0; 12.2.1.1.0; 12.2.1.2.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-3507
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-3507
Patch
http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html
Third Party Advisory
http://www.securityfocus.com/bid/97888
www.securitytracker.com
http://www.securitytracker.com/id/1038291
More from Service Bus
7.6
CVE-2017-10119
Vulnerability in the Oracle Service Bus component of Oracle Fusion Middleware (subcomponent: OSB Web Console Design, Admin)
7.5
CVE-2024-21246
Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: OSB Core Functionality)
7.3
CVE-2019-10086
In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property…
6.5
CVE-2024-21205
Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: OSB Core Functionality)
6.1
CVE-2015-9251
jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript…