CVE-2017-3360 : What You Need to Know

Oracle Customer Intelligence in Oracle E-Business Suite is vulnerable to unauthorized access and data compromise via HTTP.

Understanding CVE-2017-3360

This CVE involves a vulnerability in the User Interface subcomponent of Oracle Customer Intelligence in Oracle E-Business Suite.

What is CVE-2017-3360?

The vulnerability allows an unauthenticated attacker to compromise Oracle Customer Intelligence through network access via HTTP. Successful attacks require human interaction and can impact other products.

The Impact of CVE-2017-3360

Unauthorized access to critical data or complete data compromise in Oracle Customer Intelligence
Unauthorized modification (update, insert, delete) of accessible data
CVSS v3.0 Base Score of 8.2, affecting confidentiality and integrity

Technical Details of CVE-2017-3360

The technical aspects of this CVE are as follows:

Vulnerability Description

Vulnerability in Oracle Customer Intelligence component of Oracle E-Business Suite
Supported affected versions: 12.1.1, 12.1.2, 12.1.3

Affected Systems and Versions

Product: Customer Intelligence
Vendor: Oracle
Affected Versions: 12.1.1, 12.1.2, 12.1.3

Exploitation Mechanism

Unauthenticated attacker with network access via HTTP
Human interaction required for successful attacks

Mitigation and Prevention

Steps to address and prevent exploitation of CVE-2017-3360:

Immediate Steps to Take

Apply vendor-provided patches and updates
Monitor network traffic for signs of exploitation
Restrict network access to vulnerable systems

Long-Term Security Practices

Regularly update and patch software and systems
Conduct security training and awareness programs for employees

Patching and Updates

Refer to Oracle's security advisory for specific patch information