CVE-2017-3618 Missing authorization in Automatic Service Request (ASR)
A low-privileged attacker with local access can read, create, delete, or modify critical data in Oracle Automatic Service Request due to missing authorization checks.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-3618?
CVE-2017-3618 is a high-severity missing authorization vulnerability in Oracle Corporation Automatic Service Request (ASR), published on 24 Apr 2017. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Vulnerability in the Automatic Service Request (ASR) component of Oracle Support Tools (subcomponent: ASR Manager). The supported version that is affected is Prior to 5.7. Easily "exploitable" vulnerability allows low privileged attacker with logon to the infrastructure where Automatic Service Request (ASR) executes to compromise Automatic Service Request (ASR). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Automatic Service Request (ASR) accessible data as well as unauthorized access to critical data or complete access to all Automatic Service Request (ASR) accessible data. CVSS 3.0 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
Which versions are affected by CVE-2017-3618?
It affects 1 product.
Products include Oracle Automatic Service Request.
How do I fix CVE-2017-3618?
No fix has been published for CVE-2017-3618 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2017-3618 being exploited?
There is no known exploitation of CVE-2017-3618 in the wild and no public exploit code.
Other vulnerabilities in Oracle Corporation Automatic Service Request (ASR)
- CVE-2017-3234 Auth bypass in Automatic Service Request (ASR)
- CVE-2017-3237 Privilege escalation in Automatic Service Request (ASR)
- CVE-2017-3581 Privilege escalation in Automatic Service Request (ASR)
- CVE-2017-3620 Privilege escalation in Automatic Service Request (ASR)
- CVE-2017-3233 Missing authorization in Automatic Service Request (ASR)
Sources
Also known as GHSA-vpgc-m4f5-vj8h.