CVE-2017-3508

Critical

Published: 24/04/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

Vulnerability in the Primavera Gateway component of Oracle Primavera Products Suite allows a high privileged attacker with network access via HTTP to compromise Primavera Gateway. The attack may significantly impact additional products in the ecosystem.

Risk Assessment

The risk associated with this vulnerability includes the potential takeover of Primavera Gateway, which can lead to serious breaches of confidentiality, integrity, and availability of data.

Recommendation

It is recommended to update to the latest version of the software to mitigate this vulnerability and to monitor access to Primavera Gateway for potential attacks.

Original NVD description (English source)

Vulnerability in the Primavera Gateway component of Oracle Primavera Products Suite (subcomponent: Primavera Desktop Integration). Supported versions that are affected are 1.0, 1.1, 14.2, 15.1, 15.2, 16.1 and 16.2. Easily "exploitable" vulnerability allows high privileged attacker with network access via HTTP to compromise Primavera Gateway. While the vulnerability is in Primavera Gateway, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Primavera Gateway. CVSS 3.0 Base Score 9.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).