CVE-2017-3264 Missing authorization in Siebel UI Framework
Low-privileged attackers can modify Siebel UI Framework data via HTTP due to missing authorization checks in the Open UI component.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-3264?
CVE-2017-3264 is a low-severity missing authorization vulnerability in Oracle Siebel Ui Framework, published on 27 Jan 2017. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Vulnerability in the Siebel UI Framework component of Oracle Siebel CRM (subcomponent: Open UI). The supported version that is affected is 16.1. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel UI Framework. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Siebel UI Framework accessible data. CVSS v3.0 Base Score 3.1 (Integrity impacts).
Which versions are affected by CVE-2017-3264?
It affects 1 product.
Products include Oracle Siebel Ui Framework.
How do I fix CVE-2017-3264?
No fix has been published for CVE-2017-3264 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2017-3264 being exploited?
There is no known exploitation of CVE-2017-3264 in the wild and no public exploit code.
Other vulnerabilities in Oracle Siebel Ui Framework
Sources
Also known as GHSA-7mpj-wcrp-p76g.