PatchSiren

PatchSiren cyber security CVE debrief

CVE-2017-3361 Oracle CVE debrief

CVE-2017-3361 affects the Oracle Installed Base user interface in Oracle E-Business Suite. Oracle and NVD describe it as network-reachable over HTTP, unauthenticated, but requiring interaction from another person. Successful exploitation can expose critical data and permit unauthorized modification of some Installed Base data.

Vendor
Oracle
Product
Installed Base
CVSS
HIGH 8.2
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-27
Original CVE updated
2026-05-13
Advisory published
2017-01-27
Advisory updated
2026-05-13

Who should care

Oracle E-Business Suite administrators, application owners, and security teams responsible for Oracle Installed Base instances running versions 12.1.1, 12.1.2, or 12.1.3.

Technical summary

NVD lists this issue with CVSS v3.0 8.2 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N). The vulnerable scope is Oracle Installed Base UI, with affected CPEs for versions 12.1.1, 12.1.2, and 12.1.3. Oracle’s January 2017 Critical Patch Update is referenced as the vendor advisory/patch source.

Defensive priority

High

Recommended defensive actions

  • Apply Oracle’s January 2017 Critical Patch Update referenced in the vendor advisory for affected Oracle E-Business Suite / Installed Base versions.
  • Confirm whether any Oracle Installed Base deployments are running versions 12.1.1, 12.1.2, or 12.1.3 and prioritize them for remediation.
  • Limit exposure of the application to only required network paths, especially HTTP access, until remediation is complete.
  • Review user workflows and access controls around Installed Base because exploitation requires human interaction from a separate person.
  • Monitor Oracle application access and administrative activity for unexpected changes to Installed Base data.

Evidence notes

The supplied NVD record marks the vulnerability as modified on 2026-05-13 and published on 2017-01-27; the CVE issue date should be taken from the publishedAt field, not the later modification date. NVD cites CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N and identifies affected Oracle Installed Base versions 12.1.1, 12.1.2, and 12.1.3. Oracle’s January 2017 CPU is included in the references as the vendor patch/advisory source.

Sources and references

Verified primary and authoritative sources

  • CVE-2017-3361 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2017-3361

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2017-3361 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2017-3361

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.