CVE-2017-3528
CVE-2017-3528
Vexday Risk Score
43Attention
SSVC decision (CISA)
Attend
PoC available → attend closely
CVSS —EPSS 14.6%KEV nãoPoC públicaNuclei simMetasploit —Patch —
Lifecycle
24 Apr 2017Published on NVD
15 Jan 2018Public PoC
Recommendation: Plan a near-term fix — a public PoC already exists.
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (lists of values, datepicker, etc.)). Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Applications Framework. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Applications Framework, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Applications Framework accessible data. CVSS 3.0 Base Score 4.7 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N).
Affected products
Oracle Corporation · Applications Frameworkpublic PoCs found — 2
cve_referencewww.exploit-db.com/exploits/43592/unverifiedexploitdbwww.exploit-db.com/exploits/43592unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Want to know if your infrastructure is exposed to this?
Talk to TrueHacking →