Information disclosure in Oracle FLEXCUBE Enterprise Limits and Collateral Management - CVE-2017-3483

Vulnerability identifier: #VU12232

CSH Severity: Low

CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-3483

CWE-ID: CWE-200

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local authenticated attacker to obtain potentially sensitive information on the target system.

The weakness exists in Oracle FLEXCUBE Enterprise Limits and Collateral Management due to improper security restrictions. A local attacker can gain unauthorized read access to critical data and all of Oracle FLEXCUBE Enterprise Limits and Collateral Management accessible data.

Oracle FLEXCUBE Enterprise Limits and Collateral Management

Install update from vendor's website.

• http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html

• Multiple vulnerabilities in Oracle Financial Services Applications