Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.1

Oracle Automatic Service Request before 5.7 allows data changes

CVE-2017-3618 · published 9 years ago
Summary

The Automatic Service Request tool in Oracle versions earlier than 5.7 can be tricked by a low‑level user who can log onto the server to create, delete, or modify important data. This could let an attacker alter or view sensitive information stored by the tool. Upgrade to version 5.7 or later and limit who can log onto the server where the tool runs.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
oracle automatic_service_request <= 5.5.1
cpe:2.3:a:oracle:automatic_service_request:*:*:*:*:*:*:*:*
Original advisory text
Vulnerability in the Automatic Service Request (ASR) component of Oracle Support Tools (subcomponent: ASR Manager). The supported version that is affected is Prior to 5.7. Easily "exploitable" vuln...
Vulnerability in the Automatic Service Request (ASR) component of Oracle Support Tools (subcomponent: ASR Manager). The supported version that is affected is Prior to 5.7. Easily "exploitable" vulnerability allows low privileged attacker with logon to the infrastructure where Automatic Service Request (ASR) executes to compromise Automatic Service Request (ASR). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Automatic Service Request (ASR) accessible data as well as unauthorized access to critical data or complete access to all Automatic Service Request (ASR) accessible data. CVSS 3.0 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
7.1 High
Exploitation
<1% chance of attack within 30 days
Timeline
Published24 Apr 2017
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2017-3618 · NVD
Track software like this
Free during beta