# CVE-2016-8305: Oracle FLEXCUBE Universal Banking information disclosure in Core

Source: https://junglewise.ai/threats/cve-2016-8305-oracle-flexcube-universal-banking-information-disclosure-in-core  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2017-01-27. Updated: 2026-05-13  
License: CC BY 4.0 with a link back

CVE-2016-8305 · Severity: low · CVSS 2.1 · Published 2017-01-27

A vulnerability in the Core subcomponent of Oracle FLEXCUBE Universal Banking could allow an individual with physical access to the system to view sensitive information. This banking platform is used for managing core financial operations, and an exploit could lead to the unauthorized disclosure of a limited amount of customer or operational data. Successful exploitation requires interaction from a legitimate user other than the attacker.

Technologies: [Oracle Flexcube Universal Banking](https://junglewise.ai/threats/technologies/flexcube-universal-banking). Vendors: [Oracle](https://junglewise.ai/threats/vendors/oracle).

## Quick answers

**Is CVE-2016-8305 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2016-8305 being exploited in the wild.

**How severe is CVE-2016-8305?** Low severity, with a CVSS score of 2.1, published 27 January 2017.

**Which products and versions are affected?** Oracle Flexcube Universal Banking 11.3.0, 11.4.0, 12.0.1, 12.0.2, 12.0.3, 12.1.0, 12.2.0.

**Is there a fix for CVE-2016-8305?** A patch was published on 2017-01-17: Addressed in Oracle January 2017 Critical Patch Update Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2016-8305 attacked?** It is attacked with physical access, in a network appliance.

**Am I affected by CVE-2016-8305?** Check whether you run Oracle Flexcube Universal Banking at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability is classified as an information exposure (CWE-200) within the Core subcomponent of Oracle FLEXCUBE Universal Banking. It is exploitable only via physical access to the target system and requires human interaction from a person other than the attacker (UI:R). The root cause is not specified beyond its location in the Core subcomponent. Successful exploitation results in a low impact on confidentiality, allowing the attacker to read a subset of accessible data, while integrity and availability remain unaffected. Oracle addressed this in the January 2017 Critical Patch Update.

## Affected products

- Oracle FLEXCUBE Universal Banking 11.3.0, 11.4.0, 12.0.1, 12.0.2, 12.0.3, 12.1.0, 12.2.0

## Timeline

- 2017-01-27: advisory: Initial NVD publication date
- 2017-01-17: patched: Addressed in Oracle January 2017 Critical Patch Update

## References

- [http://www.oracle.com/technetwork/security-advisory/cpujan2017-2881727.html](http://www.oracle.com/technetwork/security-advisory/cpujan2017-2881727.html)
- [http://www.securityfocus.com/bid/95558](http://www.securityfocus.com/bid/95558)
- [http://www.securitytracker.com/id/1037636](http://www.securitytracker.com/id/1037636)

## Related threats

- [Oracle FLEXCUBE Universal Banking data manipulation in Core subcomponent](https://junglewise.ai/threats/cve-2017-3314-oracle-flexcube-universal-banking-data-manipulation-in-core)
- [Oracle FLEXCUBE Universal Banking improper input validation in Core](https://junglewise.ai/threats/cve-2017-3236-oracle-flexcube-universal-banking-improper-input-validation-in)
- [Oracle FLEXCUBE Universal Banking data manipulation via physical access](https://junglewise.ai/threats/cve-2017-3235-oracle-flexcube-universal-banking-data-manipulation-via-physical)
- [Oracle FLEXCUBE Universal Banking improper access control in Core](https://junglewise.ai/threats/cve-2016-8311-oracle-flexcube-universal-banking-improper-access-control-in-core)
- [Oracle FLEXCUBE Universal Banking security bypass in Core component](https://junglewise.ai/threats/cve-2016-8310-oracle-flexcube-universal-banking-security-bypass-in-core)