# CVE-2016-5614: Oracle FLEXCUBE Private Banking information disclosure in Product Search

Source: https://junglewise.ai/threats/cve-2016-5614-oracle-flexcube-private-banking-information-disclosure-in-product  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2017-01-27. Updated: 2026-05-13  
License: CC BY 4.0 with a link back

CVE-2016-5614 · Severity: medium · CVSS 4.3 · Published 2017-01-27

Oracle FLEXCUBE Private Banking is a financial services platform used for managing wealth and investment portfolios. A vulnerability in the search functionality allows an authorized user with low-level access to view sensitive information they are not supposed to see. This could lead to the exposure of private financial data or instrument details, potentially impacting client confidentiality.

Technologies: [Oracle Flexcube Private Banking](https://junglewise.ai/threats/technologies/flexcube-private-banking). Vendors: [Oracle](https://junglewise.ai/threats/vendors/oracle).

## Quick answers

**Is CVE-2016-5614 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2016-5614 being exploited in the wild.

**How severe is CVE-2016-5614?** Medium severity, with a CVSS score of 4.3, published 27 January 2017.

**Which products and versions are affected?** Oracle Flexcube Private Banking 2.0.1, 2.2.0, 12.0.1.

**Is there a fix for CVE-2016-5614?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2016-5614 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2016-5614?** Check whether you run Oracle Flexcube Private Banking at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An information disclosure vulnerability (CWE-200) exists in the Product / Instrument Search subcomponent of Oracle FLEXCUBE Private Banking. The flaw is easily exploitable by a low-privileged attacker with network access via HTTP. Successful exploitation allows the attacker to bypass intended access controls and perform unauthorized read operations on a subset of the application's data. The vulnerability affects versions 2.0.1, 2.2.0, and 12.0.1. Oracle addressed this issue in the January 2017 Critical Patch Update.

## Affected products

- Oracle FLEXCUBE Private Banking 2.0.1, 2.2.0, 12.0.1

## Timeline

- 2017-01-27: disclosed
- 2017-01-27: advisory: Oracle Critical Patch Update January 2017 released

## References

- [http://www.oracle.com/technetwork/security-advisory/cpujan2017-2881727.html](http://www.oracle.com/technetwork/security-advisory/cpujan2017-2881727.html)
- [http://www.securityfocus.com/bid/95474](http://www.securityfocus.com/bid/95474)
- [http://www.securitytracker.com/id/1037636](http://www.securitytracker.com/id/1037636)

## Related threats

- [Oracle FLEXCUBE Private Banking information disclosure in Product Search](https://junglewise.ai/threats/cve-2016-8313-oracle-flexcube-private-banking-information-disclosure-in-product)
- [Oracle FLEXCUBE Private Banking improper access control in Product Search](https://junglewise.ai/threats/cve-2016-8312-oracle-flexcube-private-banking-improper-access-control-in-product)
- [Oracle FLEXCUBE Private Banking integrity vulnerability in Product Search](https://junglewise.ai/threats/cve-2016-8308-oracle-flexcube-private-banking-integrity-vulnerability-in-product)
- [Oracle FLEXCUBE Private Banking improper access control in Product Search](https://junglewise.ai/threats/cve-2016-8300-oracle-flexcube-private-banking-improper-access-control-in-product)
- [Oracle FLEXCUBE Private Banking improper access control in Product Search](https://junglewise.ai/threats/cve-2016-8298-oracle-flexcube-private-banking-improper-access-control-in-product)