Is CVE-2017-3263 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2017-3263 being exploited in the wild.

How severe is CVE-2017-3263?

High severity, with a CVSS score of 8.1, published 27 January 2017.

Which products and versions are affected?

Oracle Primavera P6 Enterprise Project Portfolio Management 8.2, 8.3, 8.4, 15.1, 15.2, 16.1, 16.2.

Is there a fix for CVE-2017-3263?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2017-3263 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2017-3263?

Check whether you run Oracle Primavera P6 Enterprise Project Portfolio Management at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2017-3263: Oracle Primavera P6 EPPM improper access control in Team Member

CVE-2017-3263 · Severity: high · CVSS 8.1 · Published 2017-01-27

A vulnerability in the Team Member subcomponent of Oracle Primavera P6 EPPM allows an attacker to gain unauthorized access to project management data. Primavera P6 is used by organizations to manage large-scale project portfolios, and an exploit could lead to the unauthorized viewing, modification, or deletion of sensitive project schedules and corporate data. This could result in significant operational disruption and the loss of proprietary business information.

Technologies: Oracle Primavera P6 Enterprise Project Portfolio Management. Vendors: Oracle.

Quick answers

Is CVE-2017-3263 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2017-3263 being exploited in the wild.
How severe is CVE-2017-3263?: High severity, with a CVSS score of 8.1, published 27 January 2017.
Which products and versions are affected?: Oracle Primavera P6 Enterprise Project Portfolio Management 8.2, 8.3, 8.4, 15.1, 15.2, 16.1, 16.2.
Is there a fix for CVE-2017-3263?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2017-3263 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2017-3263?: Check whether you run Oracle Primavera P6 Enterprise Project Portfolio Management at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability affects the Team Member subcomponent of Oracle Primavera P6 Enterprise Project Portfolio Management (EPPM). It is classified as an improper access control issue that is easily exploitable by a low-privileged attacker with network access via HTTP. Successful exploitation allows the attacker to compromise the confidentiality and integrity of all accessible data within the application, including the ability to create, delete, or modify critical project records. The vulnerability does not impact system availability but provides full access to the application's data layer. Oracle addressed this issue in the January 2017 Critical Patch Update.

Affected products

Oracle Primavera P6 Enterprise Project Portfolio Management 8.2, 8.3, 8.4, 15.1, 15.2, 16.1, 16.2

Timeline

2017-01-27: disclosed
2017-01-27: advisory: Oracle Critical Patch Update published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.