Information disclosure in Oracle Database Server
CVE-2017-3240
Vulnerability in the RDBMS Security component of Oracle Database Server. The supported version that is affected is 12.1.0.2. Easily exploitable vulnerability allows low privileged attacker having Local Logon privilege with logon to the infrastructure where RDBMS Security executes to compromise RDBMS Security. Successful attacks of this vulnerability can result in unauthorized read access to a subset of RDBMS Security accessible data. CVSS v3.0 Base Score 3.3 (Confidentiality impacts).
Vulnerability class: Information Disclosure
Published · last modified .
CVSS v3 metric
CVSS v3 base score 3.3 (Low). Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.
EPSS exploit prediction
EPSS: 0.004 (30.5th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 31st percentile — 30.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: 0.000
Affected products
- Oracle Database Server — versions 12.1.0.2
- Oracle Database — versions 12.1.0.2
Weakness classification (CWE)
References
- www.securitytracker.com/id/1037630 (vdb-entry)
- www.oracle.com/technetwork/security-advisory/cpujan2017-2881727.html (Patch, Vendor Advisory)
- www.securityfocus.com/bid/95477 (vdb-entry)
Frequently asked questions
- What is CVE-2017-3240?
- CVE-2017-3240 is a low-severity vulnerability in Oracle Database Server, classified under Information Disclosure. CVSS score: 3.3/10. Published 2017-01-27.
- How severe is CVE-2017-3240?
- Low severity. CVSS v3 base score is 3.3 out of 10.