PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-8302 Oracle CVE debrief

CVE-2016-8302 is an Oracle FLEXCUBE Universal Banking information-disclosure issue affecting multiple supported releases. Oracle and NVD describe a low-privileged, network-accessible HTTP attack path that can expose a subset of accessible data, with no integrity or availability impact listed.

Vendor
Oracle
Product
CVE-2016-8302
CVSS
MEDIUM 4.3
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-27
Original CVE updated
2026-05-13
Advisory published
2017-01-27
Advisory updated
2026-05-13

Who should care

Oracle FLEXCUBE Universal Banking administrators, application security teams, and incident responders responsible for supported Oracle Financial Services Applications deployments, especially systems reachable over HTTP and used by users with lower privilege.

Technical summary

NVD lists this as CVSS 3.0 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) with CWE-200. Affected CPEs include Oracle FLEXCUBE Universal Banking versions 11.3.0, 11.4.0, 12.0.1, 12.0.2, 12.0.3, 12.1.0, and 12.2.0. The reported impact is unauthorized read access to a subset of accessible data.

Defensive priority

Medium. The issue is confidentiality-only and requires low privileges, but it is network reachable and can expose application data. Prioritize if the product is internet-facing or handles sensitive banking information.

Recommended defensive actions

  • Confirm whether any affected Oracle FLEXCUBE Universal Banking versions are in use, including 11.3.0 through 12.2.0.
  • Review Oracle's January 2017 Critical Patch Update reference for applicable remediation guidance.
  • Restrict HTTP exposure to trusted networks and reduce access paths where possible.
  • Limit low-privilege account scope and review whether exposed data can be minimized through configuration or access controls.
  • Monitor for unusual read-only access patterns and audit application logs for data-access anomalies.
  • Plan upgrade or patch deployment in line with Oracle's supported remediation guidance for the affected version.

Evidence notes

The NVD record for CVE-2016-8302 lists the CVSS 3.0 vector, CWE-200, and the affected Oracle FLEXCUBE Universal Banking CPEs. The record references Oracle's January 2017 CPU advisory, SecurityFocus BID 95554, and SecurityTracker 1037636. The CVE was published on 2017-01-27 and the NVD record was modified on 2026-05-13; that modified date is metadata, not the vulnerability date. No KEV entry is provided in the supplied corpus.

Official resources

Publicly disclosed in the CVE record on 2017-01-27. The supplied record shows a later NVD modification date of 2026-05-13, which should not be treated as the issue date.