CVE-2017-3424 Oracle CVE debrief

Who should care

Oracle E-Business Suite administrators, application security teams, and SOC teams responsible for internet-facing Oracle applications should prioritize this issue, especially where One-to-One Fulfillment is exposed to network users.

Technical summary

NVD lists affected One-to-One Fulfillment versions as 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, and 12.2.6. The CVSS v3.0 vector is AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N, indicating network attackability, no privileges required, required user interaction, scope change, high confidentiality impact, low integrity impact, and no availability impact. NVD also marks the weakness as NVD-CWE-noinfo, so the underlying flaw class is not specified in the provided corpus.

Defensive priority

High

Recommended defensive actions

• Review Oracle's January 2017 CPU advisory referenced by NVD and apply the vendor remediation for affected One-to-One Fulfillment versions.
• Inventory Oracle E-Business Suite deployments to confirm whether any affected 12.x releases are in use.
• Reduce exposure of Oracle application endpoints to trusted networks only, especially where HTTP access is not required externally.
• Because user interaction is required, reinforce user-awareness and access controls for web workflows that can reach One-to-One Fulfillment.
• Monitor for unauthorized access to critical One-to-One Fulfillment data and for unexpected updates, inserts, or deletes affecting application records.
• Validate that logging and alerting are enabled for authentication, session, and data-change events in the affected application path.

Evidence notes

The CVE description and NVD data in the supplied corpus state that the vulnerability affects Oracle One-to-One Fulfillment in Oracle E-Business Suite, with supported affected versions 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, and 12.2.6. NVD assigns CVSS v3.0 8.2 and the vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N. References in the corpus include Oracle's January 2017 security advisory and a SecurityFocus BID entry. The source corpus does not identify a specific CWE beyond NVD-CWE-noinfo.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.