PatchSiren

PatchSiren cyber security CVE debrief

CVE-2017-3287 Oracle CVE debrief

CVE-2017-3287 affects Oracle iStore in Oracle E-Business Suite and is rated CVSS 8.2 (HIGH). Oracle’s published description says an unauthenticated attacker with network access via HTTP can compromise Oracle iStore, but successful attacks require human interaction by someone other than the attacker. The issue can lead to unauthorized access to critical data or complete access to all Oracle iStore-accessible data, and may also allow unauthorized update, insert, or delete access to some of that data.

Vendor
Oracle
Product
CVE-2017-3287
CVSS
HIGH 8.2
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-27
Original CVE updated
2026-05-13
Advisory published
2017-01-27
Advisory updated
2026-05-13

Who should care

Oracle E-Business Suite owners, application security teams, and administrators responsible for Oracle iStore deployments on affected versions 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, and 12.2.6 should prioritize review. Customer-facing environments and systems exposed over HTTP deserve the most immediate attention.

Technical summary

NVD lists the flaw as network exploitable over HTTP with no privileges required and user interaction required (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N). The vulnerability is mapped to Oracle iStore CPEs for the affected versions listed in the record. Impact is primarily confidentiality and integrity: unauthorized access to critical data, full access to all iStore-accessible data, and possible unauthorized modification of some data. NVD also notes that the vulnerability may significantly impact additional products because it resides in Oracle iStore.

Defensive priority

High. The combination of unauthenticated network access, HTTP exposure, and high confidentiality/integrity impact makes this a priority issue even though human interaction is required. Systems running affected Oracle iStore versions should be reviewed and remediated promptly.

Recommended defensive actions

  • Inventory Oracle E-Business Suite systems to confirm whether Oracle iStore versions 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, or 12.2.6 are in use.
  • Review Oracle's January 2017 CPU advisory referenced by NVD for the vendor-supplied remediation guidance.
  • Apply the Oracle-provided update or patch for the affected release as soon as operationally possible.
  • Limit exposure of Oracle iStore interfaces while remediation is pending, especially where HTTP access is reachable from untrusted networks.
  • Monitor for unusual access to Oracle iStore data and unexpected insert, update, or delete activity.
  • Assess whether adjacent or dependent products could be affected, since the advisory notes potential impact beyond Oracle iStore itself.

Evidence notes

This debrief is based on the supplied NVD record and its cited references. The record states: affected versions are Oracle iStore 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, and 12.2.6; the attack vector is network/HTTP; no privileges are required; user interaction is required; and the impact is confidentiality and integrity. The NVD reference list includes Oracle CPU January 2017 as a vendor advisory/patch reference, plus third-party references to SecurityFocus and SecurityTracker. No exploit details beyond the published record were used.

Official resources

Publicly disclosed in the CVE record on 2017-01-27T22:59:03.820Z. The record was later modified on 2026-05-13T00:24:29.033Z; that later timestamp reflects record maintenance, not initial disclosure.