PatchSiren

PatchSiren cyber security CVE debrief

CVE-2017-3255 Oracle CVE debrief

CVE-2017-3255 is an Oracle JDeveloper vulnerability in the ADF Faces subcomponent that can be reached over HTTP by an unauthenticated attacker. NVD lists the issue as a confidentiality-only exposure with CVSS v3.0 5.8 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N) and identifies CWE-200. The practical risk is that exposed JDeveloper deployments may disclose a subset of accessible data without requiring login or user interaction. Oracle’s January 2017 Critical Patch Update is the vendor reference associated with this CVE, so affected installations should be reviewed against that advisory and remediated promptly.

Vendor
Oracle
Product
Jdeveloper
CVSS
MEDIUM 5.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-27
Original CVE updated
2026-05-13
Advisory published
2017-01-27
Advisory updated
2026-05-13

Who should care

Oracle JDeveloper administrators, Oracle Fusion Middleware operators, and security teams responsible for internet-facing or broadly reachable JDeveloper/ADF Faces deployments.

Technical summary

NVD marks CVE-2017-3255 as affecting Oracle JDeveloper versions 11.1.1.7.0, 11.1.1.9.0, 11.1.2.4.0, 12.1.3.0.0, 12.2.1.0.0, 12.2.1.1.0, and 12.2.1.2.0. The vulnerability is remotely exploitable over HTTP, requires no privileges or user interaction, and is categorized as an information disclosure issue (CWE-200) with low confidentiality impact and no integrity or availability impact in the NVD vector.

Defensive priority

Medium. The score is in the medium range, but the lack of authentication and network reachability make exposed deployments worth prioritizing, especially if Oracle JDeveloper is reachable beyond internal trust boundaries.

Recommended defensive actions

  • Confirm whether any Oracle JDeveloper instances match the affected versions listed by NVD.
  • Review and apply the Oracle January 2017 Critical Patch Update referenced in the vendor advisory for this CVE.
  • Restrict network exposure of JDeveloper and ADF Faces endpoints to only required administrative or internal networks.
  • Inventory any downstream products that embed or depend on Oracle JDeveloper components, since the CVE description notes potential impact beyond JDeveloper itself.
  • Validate after remediation that the affected versions are no longer present and that externally reachable HTTP access is limited as intended.

Evidence notes

This debrief is based on the NVD record for CVE-2017-3255 and its linked Oracle CPU advisory. The source data states the vulnerability is in Oracle JDeveloper ADF Faces, affects the listed JDeveloper versions, is unauthenticated and network exploitable via HTTP, and is scored CVSS v3.0 5.8 with CWE-200. The publication date used here is the CVE publishedAt date of 2017-01-27; later modification timestamps are not treated as the issue date.

Sources and references

Verified primary and authoritative sources

  • CVE-2017-3255 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2017-3255

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2017-3255 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2017-3255

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.