CVE-2017-3382 Oracle CVE debrief

Who should care

Oracle E-Business Suite administrators, application security teams, and operations teams responsible for Advanced Outbound Telephony deployments on affected 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, and 12.2.6 environments.

Technical summary

The NVD record maps the issue to Oracle Advanced Outbound Telephony and lists the affected CPEs for versions 12.1.1 through 12.2.6. The CVSS v3.0 vector is AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N, indicating a network exploitable issue with no privileges required, but with required user interaction and a scope change. Source descriptions state that successful attacks can lead to unauthorized access to critical data and unauthorized update, insert, or delete access to some accessible data.

Defensive priority

High. Although user interaction is required, the combination of unauthenticated network reachability, confidentiality impact, and integrity impact makes this a priority issue for exposed Oracle E-Business Suite instances.

Recommended defensive actions

• Review Oracle CPU January 2017 guidance and confirm whether Advanced Outbound Telephony is installed in any E-Business Suite environment.
• Identify and inventory affected versions: 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, and 12.2.6.
• Apply the Oracle vendor remediation referenced by the CPU January 2017 advisory where applicable.
• Restrict external HTTP access to Oracle E-Business Suite components and reduce exposure where business requirements allow.
• Monitor for unusual user-facing activity in Advanced Outbound Telephony workflows, since exploitation requires human interaction.
• Validate that compensating controls, patch baselines, and change records cover this component across all E-Business Suite deployments.

Evidence notes

Source data from NVD and Oracle references shows CVE publication on 2017-01-27. The description states the issue affects Oracle Advanced Outbound Telephony in Oracle E-Business Suite and lists the impacted supported versions. The CVSS vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N supports the network-reachable, unauthenticated-but-user-interactive characterization.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.