PT-2017-2024 · Oracle · Oracle Transportation Management

Published 2017-04-24 · Updated 2019-10-03 · CVE-2017-3530

Positive Technologies (AI Summary)

CVSS v2.0

7.9

High

Base vector

AV:N/AC:M/Au:S/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Oracle Transportation Manager versions 6.2, 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.4.0, 6.4.1, 6.4.2

Description The issue is related to insufficient access control in the Oracle Transportation Manager component, allowing a remote attacker to gain privileged access via HTTP requests. Successful attacks require human interaction and can result in unauthorized access to critical data or all accessible data, as well as unauthorized creation, deletion, or modification of data.

Recommendations For versions 6.2, 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.4.0, 6.4.1, 6.4.2, consider restricting access to the HTTP endpoint to minimize the risk of exploitation. As a temporary workaround, consider disabling the Security subcomponent until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2017-01191

CVE-2017-3530

Affected Products

Oracle Transportation Management

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2017-3530 · Security Note
• https://bdu.fstec.ru/vul/2017-01191 · Security Note
• https://osv.dev/vulnerability/CVE-2017-3530 · Vendor Advisory
• http://oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html · Vendor Advisory
• http://securitytracker.com/id/1038303 · Note
• http://securityfocus.com/bid/97723 · Note