Is CVE-2017-3422 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2017-3422 being exploited in the wild.

How severe is CVE-2017-3422?

High severity, with a CVSS score of 8.2, published 27 January 2017.

Which products and versions are affected?

Oracle One-To-One Fulfillment 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6.

Is there a fix for CVE-2017-3422?

A patch was published on 2017-01-17: Addressed in Oracle January 2017 Critical Patch Update Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2017-3422 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2017-3422?

Check whether you run Oracle One-To-One Fulfillment at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2017-3422: Oracle E-Business Suite One-to-One Fulfillment UI vulnerability

CVE-2017-3422 · Severity: high · CVSS 8.2 · Published 2017-01-27

A vulnerability exists in the User Interface of Oracle One-to-One Fulfillment, a component of the Oracle E-Business Suite used for managing high-volume customer communications. An unauthenticated attacker could exploit this flaw to gain unauthorized access to sensitive business data or modify existing records. Successful exploitation requires a legitimate user to interact with a malicious link or page, which could lead to a significant breach of data integrity and confidentiality across the platform.

Technologies: Oracle One-To-One Fulfillment. Vendors: Oracle.

Quick answers

Is CVE-2017-3422 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2017-3422 being exploited in the wild.
How severe is CVE-2017-3422?: High severity, with a CVSS score of 8.2, published 27 January 2017.
Which products and versions are affected?: Oracle One-To-One Fulfillment 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6.
Is there a fix for CVE-2017-3422?: A patch was published on 2017-01-17: Addressed in Oracle January 2017 Critical Patch Update Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2017-3422 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2017-3422?: Check whether you run Oracle One-To-One Fulfillment at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability in the User Interface subcomponent of Oracle One-to-One Fulfillment (Oracle E-Business Suite) allows unauthenticated attackers with network access via HTTP to compromise the system. The vulnerability is characterized by a CVSS 3.0 score of 8.2, indicating high confidentiality impact and low integrity impact. Exploitation requires human interaction from a person other than the attacker (UI:R) and has a 'Changed' scope (S:C), meaning the impact can extend beyond the vulnerable component to other parts of the E-Business Suite. Attackers can achieve unauthorized access to all accessible data or perform unauthorized updates, inserts, or deletions of certain data. Affected versions include 12.1.1-12.1.3 and 12.2.3-12.2.6. Oracle addressed this in the January 2017 Critical Patch Update.

Affected products

Oracle One-to-One Fulfillment (E-Business Suite) 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6

Timeline

2017-01-27: advisory: Initial NVD publication
2017-01-17: patched: Addressed in Oracle January 2017 Critical Patch Update

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.