Oracle FLEXCUBE Private Banking Vulnerability in Financial Services Applications
CVE-2017-3478

5.4MEDIUM

Key Information:

Vendor

Oracle
Status
Flexcube Private Banking
Vendor
CVE Published:
24 April 2017

What is CVE-2017-3478?

A vulnerability exists in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications, specifically within its Miscellaneous subcomponent. The vulnerability impacts versions 12.0.0 and 12.1.0, enabling an attacker with low privileges and network access via HTTP to potentially compromise the application. This can lead to unauthorized updates, inserts, or deletions of data, along with unauthorized read access to certain sensitive information within the system. Organizations using these affected versions should prioritize applying available patches to mitigate the risks associated with this vulnerability.

Affected Version(s)

FLEXCUBE Private Banking 12.0.0

FLEXCUBE Private Banking 12.1.0

References

http://www.oracle.com/technetwork/security-advisory/cpuap...
x_refsource_CONFIRM
http://www.securitytracker.com/id/1038304
vdb-entryx_refsource_SECTRACK
http://www.securityfocus.com/bid/97800
vdb-entryx_refsource_BID

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2017-3478 : Oracle FLEXCUBE Private Banking Vulnerability in Financial Services Applications