CVE-2017-3328 in E-Business
Summary
by MITRE
Vulnerability in the Oracle Common Applications component of Oracle E-Business Suite (subcomponent: Resources Module). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Common Applications. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Common Applications, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Common Applications accessible data as well as unauthorized update, insert or delete access to some of Oracle Common Applications accessible data. CVSS v3.0 Base Score 8.2 (Confidentiality and Integrity impacts).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 05/15/2026
The vulnerability identified as CVE-2017-3328 resides within the Oracle Common Applications component of Oracle E-Business Suite, specifically within the Resources Module subcomponent. This flaw represents a significant security weakness that affects multiple versions of the Oracle E-Business Suite including 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, and 12.2.6. The vulnerability operates at the application layer and demonstrates characteristics that align with CWE-284, which addresses improper access control mechanisms, making it particularly concerning for enterprise environments that rely heavily on Oracle's comprehensive business suite solutions.
The technical nature of this vulnerability allows an unauthenticated attacker to compromise the Oracle Common Applications through network-based HTTP access, indicating a critical weakness in the authentication and authorization frameworks implemented within the application. The CVSS v3.0 base score of 8.2 reflects the severity of the flaw, with impacts spanning both confidentiality and integrity dimensions. This means that successful exploitation could enable attackers to gain unauthorized access to critical data within the Oracle Common Applications environment, potentially leading to complete data compromise. The vulnerability's design allows for unauthorized update, insert, or delete operations against accessible data, providing attackers with extensive capabilities to manipulate or corrupt the underlying database content.
The operational impact of this vulnerability extends beyond the immediate Oracle Common Applications component, as attacks may significantly affect additional products within the Oracle E-Business Suite ecosystem. This interconnected nature of the vulnerability means that a successful exploitation could potentially cascade across multiple modules and applications that share common infrastructure or data access patterns. The requirement for human interaction from individuals other than the attacker suggests that social engineering or targeted phishing campaigns might be necessary to initially compromise systems, though once the initial access point is established, the vulnerability's network-based nature allows for automated exploitation. The attack vector through HTTP access indicates that organizations with exposed web services or poorly configured firewalls could be particularly vulnerable to this type of compromise.
Organizations should implement comprehensive mitigation strategies that include immediate patching of affected Oracle E-Business Suite versions to address the vulnerability. The ATT&CK framework categorizes this type of vulnerability under privilege escalation and credential access tactics, making it essential for security teams to monitor network traffic for suspicious HTTP requests and implement proper access controls. Network segmentation should be enforced to limit access to Oracle E-Business Suite components, while also implementing robust monitoring solutions to detect unauthorized access attempts. Additionally, organizations should conduct thorough vulnerability assessments to identify any other potentially exposed components within their Oracle infrastructure that might be susceptible to similar attacks, ensuring that the mitigation efforts address not just the immediate vulnerability but also strengthen overall security posture against similar threats.