CVE-2017-3285
HighSummary
Vulnerability in the Oracle Service Fulfillment Manager component of Oracle E-Business Suite allows an unauthenticated attacker with network access via HTTP to compromise the system. It requires interaction from a third party, which may lead to unauthorized access to critical data.
Risk Assessment
Attacks can result in unauthorized access to data and the ability to update, insert, or delete data. This may significantly impact the organization's security and data integrity.
Recommendation
It is recommended to update to the latest version of Oracle E-Business Suite and implement additional security measures to minimize the risk of exploitation of this vulnerability.
Other vulnerabilities in Oracle Service Fulfillment Manager
See all- CVE-2017-3284High
Vulnerability in the Oracle Service Fulfillment Manager component of Oracle E-Business Suite allows an unauthenticated attacker with network access via HTTP to compromise the system. It requires interaction from a third party, increasing the risk for the organization.
- CVE-2026-70786High
Vulnerability in Oracle Service Fulfillment Manager (component: Fulfillment Engine) versions 12.2.3-12.2.15. A low-privileged attacker can gain unauthorized access to critical data and modify it. Requires user interaction, CVSS 7.6.
- CVE-2026-60943High
Vulnerability in Oracle Service Fulfillment Manager (Fulfillment Engine component) versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can take over the system, but exploitation is difficult.
- CVE-2026-60942High
Vulnerability in Oracle Service Fulfillment Manager (Fulfillment Engine component) versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can gain unauthorized access to critical data and modify it.
- CVE-2026-60941High
Vulnerability in Oracle Service Fulfillment Manager (component: Fulfillment Engine) versions 12.2.3-12.2.15. Allows a high-privileged attacker with network access via HTTP to perform unauthorized creation, deletion, or modification of critical data and gain full access to all data.
Original NVD description (English source)
Vulnerability in the Oracle Service Fulfillment Manager component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Service Fulfillment Manager. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Service Fulfillment Manager, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Service Fulfillment Manager accessible data as well as unauthorized update, insert or delete access to some of Oracle Service Fulfillment Manager accessible data. CVSS v3.0 Base Score 8.2 (Confidentiality and Integrity impacts).