Is CVE-2017-3277 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2017-3277 being exploited in the wild.

How severe is CVE-2017-3277?

Medium severity, with a CVSS score of 4.9, published 27 January 2017.

Which products and versions are affected?

Oracle Applications Manager 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6; Oracle E-Business Suite 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6.

Is there a fix for CVE-2017-3277?

A patch was published on 2017-01-17: Oracle January 2017 Critical Patch Update Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2017-3277 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2017-3277?

Check whether you run Oracle Applications Manager or Oracle E-Business Suite at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2017-3277: Oracle E-Business Suite Information Disclosure in Oracle Applications Manager

CVE-2017-3277 · Severity: medium · CVSS 4.9 · Published 2017-01-27

A vulnerability exists in the Oracle Applications Manager component of the Oracle E-Business Suite, which is used by organizations to manage enterprise resources and applications. A high-privileged attacker could exploit this flaw to gain unauthorized access to sensitive business data. This could lead to a significant breach of confidentiality regarding critical corporate information managed within the suite.

Technologies: Oracle Applications Manager, Oracle E-Business Suite. Vendors: Oracle.

Quick answers

Is CVE-2017-3277 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2017-3277 being exploited in the wild.
How severe is CVE-2017-3277?: Medium severity, with a CVSS score of 4.9, published 27 January 2017.
Which products and versions are affected?: Oracle Applications Manager 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6; Oracle E-Business Suite 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6.
Is there a fix for CVE-2017-3277?: A patch was published on 2017-01-17: Oracle January 2017 Critical Patch Update Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2017-3277 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2017-3277?: Check whether you run Oracle Applications Manager or Oracle E-Business Suite at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability is classified as an information disclosure (CWE-200) within the OAM Client subcomponent of Oracle Applications Manager. It is easily exploitable by a high-privileged attacker with network access via HTTP. The flaw allows an attacker to bypass intended confidentiality protections to access critical data or all data accessible to the Oracle Applications Manager. The vulnerability affects Oracle E-Business Suite versions 12.1.3 and 12.2.3 through 12.2.6. Oracle addressed this issue in the January 2017 Critical Patch Update.

Affected products

Oracle E-Business Suite (Oracle Applications Manager) 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6

Timeline

2017-01-27: disclosed
2017-01-27: advisory: NVD publication date
2017-01-17: patched: Oracle January 2017 Critical Patch Update

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.