CVE-2017-3311
CVE-2017-3311 is a medium-severity vulnerability in Oracle Application Testing Suite with a CVSS 3.x base score of 5.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.
Key facts
- Severity: Medium (CVSS 3.x base score 5.3)
- CVSS v2: 5.0
- EPSS exploit prediction: 1% (71st percentile)
- Actively exploited: Not listed in CISA KEV
- Affected product: Oracle Application Testing Suite
- Published:
- Last modified:
Description
Vulnerability in the Application Testing Suite component of Oracle Enterprise Manager Grid Control (subcomponent: Test Manager for Web Apps). Supported versions that are affected are 12.5.0.3, 12.5.0.2 and 12.4.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Application Testing Suite. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Application Testing Suite accessible data. CVSS v3.0 Base Score 5.3 (Integrity impacts).
Frequently asked questions
- What is CVE-2017-3311?
- Vulnerability in the Application Testing Suite component of Oracle Enterprise Manager Grid Control (subcomponent: Test Manager for Web Apps). Supported versions that are affected are 12.5.0.3, 12.5.0.2 and 12.4.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Application Testing Suite. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Application Testing Suite accessible data. CVSS v3.0 Base Score 5.3 (Integrity impacts).
- How severe is CVE-2017-3311?
- CVE-2017-3311 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity low, and availability none.
- Is CVE-2017-3311 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (71st percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2017-3311?
- CVE-2017-3311 primarily affects Oracle Application Testing Suite. In total, 3 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2017-3311?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- When was CVE-2017-3311 published?
- CVE-2017-3311 was published on 2017-01-27 and last updated on 2026-06-17.
References
- http://www.oracle.com/technetwork/security-advisory/cpujan2017-2881727.html
- http://www.securityfocus.com/bid/95584
- http://www.securitytracker.com/id/1037633
Affected products (3)
- cpe:2.3:a:oracle:application_testing_suite:12.4.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:application_testing_suite:12.5.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:application_testing_suite:12.5.0.3:*:*:*:*:*:*:*
More vulnerabilities in Oracle Application Testing Suite
- CVE-2018-1285 — Critical (CVSS 9.8): Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files.…
- CVE-2020-10683 — Critical (CVSS 9.8): dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE…
- CVE-2019-17571 — Critical (CVSS 9.8): Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be…
- CVE-2019-2904 — Critical (CVSS 9.8): Vulnerability in the Oracle JDeveloper and ADF product of Oracle Fusion Middleware (component: ADF Faces). Supported…
- CVE-2018-11058 — Critical (CVSS 9.8): RSA BSAFE Micro Edition Suite, versions prior to 4.0.11 (in 4.0.x) and prior to 4.1.6 (in 4.1.x), and RSA BSAFE…
- CVE-2018-1275 — Critical (CVSS 9.8): Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.16 and older unsupported versions, allow…