PatchSiren

PatchSiren cyber security CVE debrief

CVE-2017-3364 Oracle CVE debrief

CVE-2017-3364 is a high-severity Oracle Knowledge Management vulnerability in Oracle E-Business Suite. Oracle and NVD identify affected supported versions as 12.1.1, 12.1.2, and 12.1.3. The issue is network-reachable over HTTP, requires no attacker authentication, and can still have serious consequences because successful exploitation may expose critical data or allow unauthorized updates, inserts, or deletes in Oracle Knowledge Management. The CVSS v3.0 score is 8.2, reflecting a strong confidentiality and integrity impact.

Vendor
Oracle
Product
Knowledge Management
CVSS
HIGH 8.2
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-27
Original CVE updated
2026-05-13
Advisory published
2017-01-27
Advisory updated
2026-05-13

Who should care

Oracle E-Business Suite administrators, application owners, and security teams responsible for Oracle Knowledge Management deployments, especially environments exposing the interface to network access.

Technical summary

The supplied NVD record describes a vulnerability in the Oracle Knowledge Management component of Oracle E-Business Suite, specifically the User Interface subcomponent. The attack vector is network-based (AV:N) with low attack complexity (AC:L), no privileges required (PR:N), and user interaction required (UI:R). NVD assigns CVSS v3.0 8.2 with scope changed and impacts of high confidentiality (C:H), low integrity (I:L), and no availability impact (A:N). Oracle/NVD list supported affected versions as 12.1.1, 12.1.2, and 12.1.3.

Defensive priority

High. The vulnerability is unauthenticated and network-reachable, and it can expose sensitive data or permit unauthorized changes, even though successful exploitation requires human interaction.

Recommended defensive actions

  • Confirm whether Oracle E-Business Suite Knowledge Management 12.1.1, 12.1.2, or 12.1.3 is deployed in your environment.
  • Apply the Oracle Critical Patch Update for January 2017 or the latest cumulative Oracle patches that include the fix for CVE-2017-3364.
  • Restrict network access to the Knowledge Management interface to trusted users and networks where possible.
  • Review access controls and user workflows around the Knowledge Management UI to reduce exposure to untrusted interaction.
  • Monitor for unusual Knowledge Management activity, especially unexpected data reads or change operations.
  • Use the Oracle security advisory and NVD record to validate remediation status and affected product scope.

Evidence notes

This debrief is based on the supplied NVD CVE record and Oracle vendor advisory reference. The record states the affected Oracle Knowledge Management versions, the HTTP/network attack context, the user-interaction requirement, and the CVSS v3.0 vector CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N. The CVE was published on 2017-01-27 and the NVD record was modified on 2026-05-13; those dates are used only as record timing context.

Sources and references

Verified primary and authoritative sources

  • CVE-2017-3364 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2017-3364

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2017-3364 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2017-3364

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.