PatchSiren

PatchSiren cyber security CVE debrief

CVE-2017-3415 Oracle CVE debrief

CVE-2017-3415 is a high-severity Oracle Universal Work Queue issue in Oracle E-Business Suite. According to the supplied NVD record, it affects supported versions 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, and 12.2.6. Oracle describes it as easily exploitable by an unauthenticated attacker with network access via HTTP, but successful exploitation requires human interaction. The stated impact includes unauthorized access to critical data and unauthorized update, insert, or delete access to some accessible data.

Vendor
Oracle
Product
CVE-2017-3415
CVSS
HIGH 8.2
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-27
Original CVE updated
2026-05-13
Advisory published
2017-01-27
Advisory updated
2026-05-13

Who should care

Oracle E-Business Suite owners, application security teams, identity and access management teams, and administrators responsible for Oracle Universal Work Queue deployments should prioritize this issue. Organizations exposing the affected UI to reachable networks should pay particular attention because exploitation is network-based and does not require prior authentication.

Technical summary

The supplied record describes a vulnerability in the Oracle Universal Work Queue component of Oracle E-Business Suite, specifically the User Interface subcomponent. NVD lists the affected CPEs for versions 12.1.1 through 12.1.3 and 12.2.3 through 12.2.6. The CVSS v3.0 vector is AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N, which indicates network attackability, low complexity, no privileges required, and a user-interaction dependency, with high confidentiality impact and low integrity impact. The record does not provide a root cause or exploit chain.

Defensive priority

High. This issue is remotely reachable, unauthenticated, and rated CVSS 8.2, but it depends on user interaction. That combination makes exposure management, patching, and access restriction important for any environment running the affected Oracle E-Business Suite versions.

Recommended defensive actions

  • Confirm whether Oracle Universal Work Queue is deployed in any Oracle E-Business Suite environment and identify the affected versions listed in the NVD record.
  • Review the Oracle Critical Patch Update advisory referenced by NVD for January 2017 and apply Oracle's remediation guidance where applicable.
  • Limit network exposure to the Oracle E-Business Suite UI and restrict HTTP access to only approved administrative or user networks.
  • Validate that compensating controls such as segmentation, authentication boundaries, and browser/user awareness controls are in place because exploitation requires human interaction.
  • After remediation, verify patch status and monitor Oracle E-Business Suite access logs for unusual UI activity or unexpected requests to the affected component.

Evidence notes

All substantive facts in this debrief come from the supplied NVD record and its linked metadata: the vulnerable component is Oracle Universal Work Queue in Oracle E-Business Suite, the affected versions are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, and 12.2.6, and the attack conditions include network access via HTTP plus required human interaction. The supplied CVSS vector is CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N with a base score of 8.2. The corpus does not include Oracle advisory content, root cause details, or exploit specifics, so those are intentionally not expanded here.

Official resources

Publicly disclosed in the supplied record on 2017-01-27T22:59:07.430Z. The NVD record was modified on 2026-05-13T00:24:29.033Z. No KEV listing was provided in the supplied corpus.