CVE-2017-3284
HighSummary
Vulnerability in the Oracle Service Fulfillment Manager component of Oracle E-Business Suite allows an unauthenticated attacker with network access via HTTP to compromise the system. It requires interaction from a third party, increasing the risk for the organization.
Risk Assessment
Attacks may lead to unauthorized access to critical data and complete access to all data accessible in Oracle Service Fulfillment Manager. This can result in serious consequences for data security.
Recommendation
It is recommended to update to the latest version of Oracle E-Business Suite and implement additional security measures to minimize the risk associated with this vulnerability.
Other vulnerabilities in Oracle Service Fulfillment Manager
See all- CVE-2017-3285High
Vulnerability in the Oracle Service Fulfillment Manager component of Oracle E-Business Suite allows an unauthenticated attacker with network access via HTTP to compromise the system. It requires interaction from a third party, which may lead to unauthorized access to critical data.
- CVE-2026-70786High
Vulnerability in Oracle Service Fulfillment Manager (component: Fulfillment Engine) versions 12.2.3-12.2.15. A low-privileged attacker can gain unauthorized access to critical data and modify it. Requires user interaction, CVSS 7.6.
- CVE-2026-60943High
Vulnerability in Oracle Service Fulfillment Manager (Fulfillment Engine component) versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can take over the system, but exploitation is difficult.
- CVE-2026-60942High
Vulnerability in Oracle Service Fulfillment Manager (Fulfillment Engine component) versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can gain unauthorized access to critical data and modify it.
- CVE-2026-60941High
Vulnerability in Oracle Service Fulfillment Manager (component: Fulfillment Engine) versions 12.2.3-12.2.15. Allows a high-privileged attacker with network access via HTTP to perform unauthorized creation, deletion, or modification of critical data and gain full access to all data.
Original NVD description (English source)
Vulnerability in the Oracle Service Fulfillment Manager component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Service Fulfillment Manager. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Service Fulfillment Manager, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Service Fulfillment Manager accessible data as well as unauthorized update, insert or delete access to some of Oracle Service Fulfillment Manager accessible data. CVSS v3.0 Base Score 8.2 (Confidentiality and Integrity impacts).