Oracle FLEXCUBE Private Banking Component Vulnerability Exposes Data Risks

CVE-2016-8282

Summary

A vulnerability exists in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications, specifically in the Product / Instrument Search subcomponent. This vulnerability allows an unauthenticated attacker with network access via HTTP to compromise the system. To successfully exploit this vulnerability, human interaction is required from an individual other than the attacker. While the vulnerability itself pertains to Oracle FLEXCUBE Private Banking, the effects of successful attacks can impact additional products significantly. Exploitation of this vulnerability can lead to unauthorized manipulations of accessible data, including updates, inserts, and deletes, as well as unauthorized reading of certain data within Oracle FLEXCUBE Private Banking.

References