CVE-2017-3478
MEDIUMOracle FLEXCUBE <12.1.0 - Unauthorized Update
Title source: llmDescription
Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Miscellaneous). Supported versions that are affected are 12.0.0 and 12.1.0. Easily "exploitable" vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Private Banking. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle FLEXCUBE Private Banking accessible data as well as unauthorized read access to a subset of Oracle FLEXCUBE Private Banking accessible data. CVSS 3.0 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).
Scores
CVSS v3
5.4
EPSS
0.0022
EPSS Percentile
44.5%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Classification
Status
published
Affected Products (4)
oracle/flexcube_private_banking
oracle/flexcube_private_banking
Oracle Corporation/FLEXCUBE Private Banking
< 12.0.0
Oracle Corporation/FLEXCUBE Private Banking
< 12.1.0
Timeline
Published
Apr 24, 2017
Tracked Since
Feb 18, 2026