PatchSiren

PatchSiren cyber security CVE debrief

CVE-2017-3255 Oracle CVE debrief

CVE-2017-3255 is an Oracle JDeveloper vulnerability in the ADF Faces subcomponent that can be reached over HTTP by an unauthenticated attacker. NVD lists the issue as a confidentiality-only exposure with CVSS v3.0 5.8 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N) and identifies CWE-200. The practical risk is that exposed JDeveloper deployments may disclose a subset of accessible data without requiring login or user interaction. Oracle’s January 2017 Critical Patch Update is the vendor reference associated with this CVE, so affected installations should be reviewed against that advisory and remediated promptly.

Vendor
Oracle
Product
CVE-2017-3255
CVSS
MEDIUM 5.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-27
Original CVE updated
2026-05-13
Advisory published
2017-01-27
Advisory updated
2026-05-13

Who should care

Oracle JDeveloper administrators, Oracle Fusion Middleware operators, and security teams responsible for internet-facing or broadly reachable JDeveloper/ADF Faces deployments.

Technical summary

NVD marks CVE-2017-3255 as affecting Oracle JDeveloper versions 11.1.1.7.0, 11.1.1.9.0, 11.1.2.4.0, 12.1.3.0.0, 12.2.1.0.0, 12.2.1.1.0, and 12.2.1.2.0. The vulnerability is remotely exploitable over HTTP, requires no privileges or user interaction, and is categorized as an information disclosure issue (CWE-200) with low confidentiality impact and no integrity or availability impact in the NVD vector.

Defensive priority

Medium. The score is in the medium range, but the lack of authentication and network reachability make exposed deployments worth prioritizing, especially if Oracle JDeveloper is reachable beyond internal trust boundaries.

Recommended defensive actions

  • Confirm whether any Oracle JDeveloper instances match the affected versions listed by NVD.
  • Review and apply the Oracle January 2017 Critical Patch Update referenced in the vendor advisory for this CVE.
  • Restrict network exposure of JDeveloper and ADF Faces endpoints to only required administrative or internal networks.
  • Inventory any downstream products that embed or depend on Oracle JDeveloper components, since the CVE description notes potential impact beyond JDeveloper itself.
  • Validate after remediation that the affected versions are no longer present and that externally reachable HTTP access is limited as intended.

Evidence notes

This debrief is based on the NVD record for CVE-2017-3255 and its linked Oracle CPU advisory. The source data states the vulnerability is in Oracle JDeveloper ADF Faces, affects the listed JDeveloper versions, is unauthenticated and network exploitable via HTTP, and is scored CVSS v3.0 5.8 with CWE-200. The publication date used here is the CVE publishedAt date of 2017-01-27; later modification timestamps are not treated as the issue date.

Official resources

Publicly disclosed on 2017-01-27. NVD later updated the record on 2026-05-13, but that modified date is not the vulnerability’s disclosure date.