PatchSiren

PatchSiren cyber security CVE debrief

CVE-2017-3376 Oracle CVE debrief

CVE-2017-3376 is a vulnerability in the Oracle Advanced Outbound Telephony component of Oracle E-Business Suite, specifically the User Interface subcomponent. Oracle and NVD describe it as easily exploitable over HTTP by an unauthenticated attacker, but successful attacks require human interaction by someone other than the attacker. The impact is primarily on confidentiality and integrity, with potential unauthorized access to critical data and unauthorized update, insert, or delete access to some accessible data.

Vendor
Oracle
Product
Advanced Outbound Telephony
CVSS
HIGH 8.2
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-27
Original CVE updated
2026-05-13
Advisory published
2017-01-27
Advisory updated
2026-05-13

Who should care

Oracle E-Business Suite administrators, application owners, and security teams responsible for Advanced Outbound Telephony deployments, especially environments running any of the affected versions listed by Oracle and NVD.

Technical summary

The NVD vector is CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N, indicating a network-reachable issue with no privileges required but with user interaction needed. The affected Oracle Advanced Outbound Telephony versions listed in the source data are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, and 12.2.6. The source corpus does not provide a specific CWE beyond NVD-CWE-noinfo.

Defensive priority

High. The flaw is unauthenticated, network-accessible, and can expose or alter sensitive application data, even though user interaction is required.

Recommended defensive actions

  • Apply the Oracle January 2017 CPU referenced in the vendor advisory for affected systems.
  • Verify whether any Oracle E-Business Suite instances include Advanced Outbound Telephony versions 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, or 12.2.6.
  • Restrict exposure of the affected application paths to trusted networks and users while patching is planned.
  • Review application access controls and user activity for unexpected data access or modifications after remediation.
  • Track Oracle and NVD advisories for any follow-up guidance or version-specific remediation details.

Evidence notes

All facts in this debrief come from the supplied NVD record and its referenced Oracle vendor advisory. The issue was published in the source record on 2017-01-27 and later modified in NVD on 2026-05-13; that later date reflects record maintenance, not a new vulnerability date. The source data does not include a KEV listing.

Sources and references

Verified primary and authoritative sources

  • CVE-2017-3376 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2017-3376

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2017-3376 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2017-3376

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.