PatchSiren

PatchSiren cyber security CVE debrief

CVE-2017-3359 Oracle CVE debrief

CVE-2017-3359 is an Oracle Customer Intelligence vulnerability in Oracle E-Business Suite affecting supported versions 12.1.1, 12.1.2, and 12.1.3. Oracle and NVD describe it as network-accessible over HTTP and easily exploitable, but with successful attacks requiring human interaction. Impact can include unauthorized access to critical data and unauthorized update, insert, or delete access to some Customer Intelligence data. Oracle addressed it in the January 2017 CPU referenced by NVD.

Vendor
Oracle
Product
CVE-2017-3359
CVSS
HIGH 8.2
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-27
Original CVE updated
2026-05-13
Advisory published
2017-01-27
Advisory updated
2026-05-13

Who should care

Administrators and security teams responsible for Oracle E-Business Suite, especially environments using the Customer Intelligence component on versions 12.1.1, 12.1.2, or 12.1.3.

Technical summary

NVD lists the vulnerability with CVSS v3.0 vector CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N, indicating network attackability, no privileges required, and a user-interaction requirement. The affected CPEs are Oracle Customer Intelligence 12.1.1, 12.1.2, and 12.1.3. NVD also records impacts to confidentiality and integrity, and the source references Oracle's January 2017 CPU as the vendor advisory/patch reference.

Defensive priority

High for any environment running the affected Oracle Customer Intelligence versions, because the issue is network-reachable and can expose or alter sensitive application data.

Recommended defensive actions

  • Verify whether Oracle E-Business Suite Customer Intelligence 12.1.1, 12.1.2, or 12.1.3 is deployed anywhere in your environment.
  • Review Oracle's January 2017 Critical Patch Update referenced by NVD and apply the vendor remediation for affected systems.
  • Restrict exposure of Oracle E-Business Suite interfaces to trusted networks where possible, especially HTTP-accessible paths.
  • Confirm whether any users may have interacted with suspicious or unexpected application content around the time of exposure.
  • Reassess data access controls and audit logs for unauthorized read or modification activity in Customer Intelligence data stores.

Evidence notes

This debrief is based on the NVD CVE record and its listed references. NVD records the affected CPEs as Oracle Customer Intelligence 12.1.1/12.1.2/12.1.3 and the CVSS v3.0 vector CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N. The NVD reference list includes Oracle's January 2017 CPU advisory as a patch/vendor advisory reference, along with SecurityFocus BID 95464 and SecurityTracker 1037639. No exploit details beyond the supplied vulnerability description are included.

Official resources

CVE published 2017-01-27T22:59:05.617Z. NVD record modified 2026-05-13T00:24:29.033Z.