cnvd - cnvd-2017-06279

cnvd-2017-06279

Vulnerability from cnvd

Title

Oracle FLEXCUBE Investor Servicing未授权修改漏洞

Description

Oracle Financial Services Applications是美国甲骨文（Oracle）公司的一套集核心银行、网上银行和财产管理于一身的金融服务软件。Oracle FLEXCUBE Investor Servicing是其中的一个提供跨业务对冲基金、共同基金和单位挂钩保险产品的生命周期处理的组件。 Oracle Financial Services Applications中的Oracle FLEXCUBE Investor Servicing组件的Unit Trust子组件存在安全漏洞。攻击者可利用该漏洞未授权更新、插入或删除数据，影响数据的完整性。

Severity

低

Patch Name

Oracle FLEXCUBE Investor Servicing未授权修改漏洞的补丁

Patch Description

Formal description

目前厂商已经发布了升级补丁以修复此安全问题，补丁获取链接： http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html

Reference

http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html

Impacted products

Name
['Oracle FLEXCUBE Investor Servicing 12.0.4', 'Oracle FLEXCUBE Investor Servicing 12.0.2', 'Oracle FLEXCUBE Investor Servicing 12.0.1', 'Oracle FLEXCUBE Investor Servicing 12.0.3', 'Oracle FLEXCUBE Investor Servicing 12.1.0', 'Oracle FLEXCUBE Investor Servicing 12.2.0', 'Oracle FLEXCUBE Investor Servicing 12.3.0']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2017-3487",
      "cveUrl": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3487"
    }
  },
  "description": "Oracle Financial Services Applications\u662f\u7f8e\u56fd\u7532\u9aa8\u6587\uff08Oracle\uff09\u516c\u53f8\u7684\u4e00\u5957\u96c6\u6838\u5fc3\u94f6\u884c\u3001\u7f51\u4e0a\u94f6\u884c\u548c\u8d22\u4ea7\u7ba1\u7406\u4e8e\u4e00\u8eab\u7684\u91d1\u878d\u670d\u52a1\u8f6f\u4ef6\u3002Oracle FLEXCUBE Investor Servicing\u662f\u5176\u4e2d\u7684\u4e00\u4e2a\u63d0\u4f9b\u8de8\u4e1a\u52a1\u5bf9\u51b2\u57fa\u91d1\u3001\u5171\u540c\u57fa\u91d1\u548c\u5355\u4f4d\u6302\u94a9\u4fdd\u9669\u4ea7\u54c1\u7684\u751f\u547d\u5468\u671f\u5904\u7406\u7684\u7ec4\u4ef6\u3002\r\n\r\nOracle Financial Services Applications\u4e2d\u7684Oracle FLEXCUBE Investor Servicing\u7ec4\u4ef6\u7684Unit Trust\u5b50\u7ec4\u4ef6\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u672a\u6388\u6743\u66f4\u65b0\u3001\u63d2\u5165\u6216\u5220\u9664\u6570\u636e\uff0c\u5f71\u54cd\u6570\u636e\u7684\u5b8c\u6574\u6027\u3002",
  "discovererName": "Oracle",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u7ecf\u53d1\u5e03\u4e86\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6b64\u5b89\u5168\u95ee\u9898\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttp://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2017-06279",
  "openTime": "2017-05-11",
  "patchDescription": "Oracle Financial Services Applications\u662f\u7f8e\u56fd\u7532\u9aa8\u6587\uff08Oracle\uff09\u516c\u53f8\u7684\u4e00\u5957\u96c6\u6838\u5fc3\u94f6\u884c\u3001\u7f51\u4e0a\u94f6\u884c\u548c\u8d22\u4ea7\u7ba1\u7406\u4e8e\u4e00\u8eab\u7684\u91d1\u878d\u670d\u52a1\u8f6f\u4ef6\u3002Oracle FLEXCUBE Investor Servicing\u662f\u5176\u4e2d\u7684\u4e00\u4e2a\u63d0\u4f9b\u8de8\u4e1a\u52a1\u5bf9\u51b2\u57fa\u91d1\u3001\u5171\u540c\u57fa\u91d1\u548c\u5355\u4f4d\u6302\u94a9\u4fdd\u9669\u4ea7\u54c1\u7684\u751f\u547d\u5468\u671f\u5904\u7406\u7684\u7ec4\u4ef6\u3002\r\n\r\nOracle Financial Services Applications\u4e2d\u7684Oracle FLEXCUBE Investor Servicing\u7ec4\u4ef6\u7684Unit Trust\u5b50\u7ec4\u4ef6\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u672a\u6388\u6743\u66f4\u65b0\u3001\u63d2\u5165\u6216\u5220\u9664\u6570\u636e\uff0c\u5f71\u54cd\u6570\u636e\u7684\u5b8c\u6574\u6027\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Oracle FLEXCUBE Investor Servicing\u672a\u6388\u6743\u4fee\u6539\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Oracle FLEXCUBE Investor Servicing  12.0.4",
      "Oracle FLEXCUBE Investor Servicing  12.0.2",
      "Oracle FLEXCUBE Investor Servicing 12.0.1",
      "Oracle FLEXCUBE Investor Servicing 12.0.3",
      "Oracle FLEXCUBE Investor Servicing 12.1.0",
      "Oracle FLEXCUBE Investor Servicing 12.2.0",
      "Oracle FLEXCUBE Investor Servicing 12.3.0"
    ]
  },
  "referenceLink": "http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html",
  "serverity": "\u4f4e",
  "submitTime": "2017-04-28",
  "title": "Oracle FLEXCUBE Investor Servicing\u672a\u6388\u6743\u4fee\u6539\u6f0f\u6d1e"
}

CVE-2017-3487 (GCVE-0-2017-3487)

Vulnerability from cvelistv5

Published

2017-04-24 19:00

Modified

2024-10-07 16:16

Severity ?

CWE

Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Investor Servicing. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle FLEXCUBE Investor Servicing accessible data.

Summary

Vulnerability in the Oracle FLEXCUBE Investor Servicing component of Oracle Financial Services Applications (subcomponent: Unit Trust). Supported versions that are affected are 12.0.1, 12.0.2, 12.0.3, 12.0.4, 12.1.0, 12.2.0 and 12.3.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Investor Servicing. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle FLEXCUBE Investor Servicing accessible data. CVSS 3.0 Base Score 3.1 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N).

References

URL

Tags

	http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html	x_refsource_CONFIRM
	http://www.securitytracker.com/id/1038304	vdb-entry, x_refsource_SECTRACK
	http://www.securityfocus.com/bid/97871	vdb-entry, x_refsource_BID