CVE-2017-3441 Oracle CVE debrief

Who should care

Oracle E-Business Suite administrators, application security teams, and incident responders responsible for environments running Customer Interaction History 12.1.1, 12.1.2, or 12.1.3 should prioritize review and remediation. Organizations exposing the affected component to network access via HTTP should be especially attentive.

Technical summary

NVD maps the affected Oracle Customer Interaction History component to CPEs for versions 12.1.1, 12.1.2, and 12.1.3. The published CVSS v3.0 vector is AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N with a base score of 8.2. That means the attack is network-reachable, requires no privileges, does require user interaction, and can impact confidentiality and integrity across scope beyond the vulnerable component. NVD does not provide a more specific CWE beyond NVD-CWE-noinfo.

Defensive priority

High. The combination of network reachability, no authentication, and meaningful confidentiality/integrity impact makes this a priority for patch validation and exposure review, especially in production E-Business Suite deployments.

Recommended defensive actions

• Confirm whether Oracle E-Business Suite Customer Interaction History 12.1.1, 12.1.2, or 12.1.3 is deployed in your environment.
• Review Oracle's January 2017 Critical Patch Update advisory for the vendor-recommended remediation path.
• Apply the vendor patch or mitigation referenced by Oracle as soon as feasible.
• Restrict network exposure to the affected HTTP-accessible component until remediation is complete.
• Monitor for unusual access to Customer Interaction History data and for unexpected update, insert, or delete activity.
• Verify whether any dependent products or workflows could be affected by compromise of this component.

Evidence notes

All statements are drawn from the supplied NVD record and Oracle reference links. The CVE was published on 2017-01-27. NVD lists affected CPEs for Oracle Customer Interaction History versions 12.1.1, 12.1.2, and 12.1.3 and records CVSS v3.0 8.2 with vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N. NVD also marks the weakness as NVD-CWE-noinfo, so a more precise CWE is not supported by the source corpus here.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.