Is CVE-2016-8317 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2016-8317 being exploited in the wild.

How severe is CVE-2016-8317?

Medium severity, with a CVSS score of 5.3, published 27 January 2017.

Which products and versions are affected?

Oracle Flexcube Investor Servicing 12.0.1, 12.0.2, 12.0.4, 12.1.0, 12.3.0.

Is there a fix for CVE-2016-8317?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2016-8317 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2016-8317?

Check whether you run Oracle Flexcube Investor Servicing at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2016-8317: Oracle FLEXCUBE Investor Servicing improper access control in Unit Trust

CVE-2016-8317 · Severity: medium · CVSS 5.3 · Published 2017-01-27

A vulnerability exists in Oracle FLEXCUBE Investor Servicing, a platform used by financial institutions to manage investment portfolios and unit trusts. An attacker with low-level access to the system could potentially modify, create, or delete critical financial data. This could lead to significant data integrity issues and unauthorized changes to investor records or transaction history.

Technologies: Oracle Flexcube Investor Servicing. Vendors: Oracle.

Quick answers

Is CVE-2016-8317 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2016-8317 being exploited in the wild.
How severe is CVE-2016-8317?: Medium severity, with a CVSS score of 5.3, published 27 January 2017.
Which products and versions are affected?: Oracle Flexcube Investor Servicing 12.0.1, 12.0.2, 12.0.4, 12.1.0, 12.3.0.
Is there a fix for CVE-2016-8317?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2016-8317 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2016-8317?: Check whether you run Oracle Flexcube Investor Servicing at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability is classified as an improper access control issue (CWE-284) within the Unit Trust subcomponent of Oracle FLEXCUBE Investor Servicing. It is reachable via the HTTP protocol and requires the attacker to have low-privileged credentials. While the attack complexity is rated as high, a successful exploit allows an attacker to perform unauthorized creation, deletion, or modification of all accessible data within the component. The impact is limited to data integrity, with no reported impact on confidentiality or availability. Oracle addressed this in the January 2017 Critical Patch Update.

Affected products

Oracle FLEXCUBE Investor Servicing 12.0.1, 12.0.2, 12.0.4, 12.1.0, 12.3.0

Timeline

2017-01-27: advisory: Initial disclosure in Oracle Critical Patch Update
2017-01-27: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.