Information disclosure in Oracle FLEXCUBE Enterprise Limits and Collateral Management - CVE-2017-3491

Vulnerability identifier: #VU12216

CSH Severity: Low

CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-3491

CWE-ID: CWE-200

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote authenticated attacker to obtain potentially sensitive information on the target system.

The weakness exists in Oracle FLEXCUBE Enterprise Limits and Collateral Management due to improper security restrictions. A remote attacker can gain unauthorized access to critical data or complete access to all Oracle FLEXCUBE Enterprise Limits and Collateral Management accessible data.

Oracle FLEXCUBE Enterprise Limits and Collateral Management

Install update from vendor's website.

• http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html

• Multiple vulnerabilities in Oracle Financial Services Applications