#VU11594 Improper access control in JD Edwards EnterpriseOne Tools - CVE-2017-3517

Vulnerability identifier: #VU11594

Vulnerability risk: Low

CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

CVE-ID: CVE-2017-3517

CWE-ID: CWE-284

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerable software:
JD Edwards EnterpriseOne Tools

Software vendor:
Oracle

The vulnerability allows a remote unauthenticated attacker to obtain potentially sensitive information and cause DoS condition on the target system.

The weakness exists in the JD Edwards EnterpriseOne Tools component due to improper access control. A remote attacker can gain access to potentially sensitive information and cause the service to crash.

Install update from vendor's website.

• http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html