// For flags

CVE-2017-3500

 

Severity Score

8.7
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Vulnerability in the Primavera Gateway component of Oracle Primavera Products Suite (subcomponent: Primavera Desktop Integration). Supported versions that are affected are 1.0, 1.1, 14.2, 15.1, 15.2, 16.1 and 16.2. Easily "exploitable" vulnerability allows high privileged attacker with network access via HTTP to compromise Primavera Gateway. While the vulnerability is in Primavera Gateway, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Primavera Gateway accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Primavera Gateway. CVSS 3.0 Base Score 8.7 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:H).

Vulnerabilidad en el componente Primavera Gateway de Oracle Primavera Products Suite (subcomponente: Primavera Desktop Integration). Versiones compatibles que son afectadas son 1.0, 1.1, 14.2, 15.1, 15.2, 16.1 y 16.2. Permite a atacante de alto privilegio con acceso a la red a través de HTTP comprometer Primavera Gateway. Aunque la vulnerabilidad está en Primavera Gateway, los ataques pueden afectar significativamente a otros productos. Los ataques exitosos de esta vulnerabilidad pueden resultar en acceso no autorizado a datos críticos o acceso completo a todos los datos accesibles de Primavera Gateway y capacidad no autorizada para causar un bloqueo o repetición frecuente (Complete DOS) de Primavera Gateway.CVSS 3.0 Base Score 8.7 (Confidentiality and Impactos de disponibilidad). Vector CVSS: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:H).

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
None
Availability
High
Attack Vector
Network
Attack Complexity
Medium
Authentication
Single
Confidentiality
Partial
Integrity
None
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2016-12-06 CVE Reserved
  • 2017-04-24 CVE Published
  • 2023-03-08 EPSS Updated
  • 2024-08-05 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Oracle
Search vendor "Oracle"
 Primavera Gateway
Search vendor "Oracle" for product "Primavera Gateway"
 1.0
Search vendor "Oracle" for product "Primavera Gateway" and version "1.0"
-
Affected
Oracle
Search vendor "Oracle"
 Primavera Gateway
Search vendor "Oracle" for product "Primavera Gateway"
 1.1
Search vendor "Oracle" for product "Primavera Gateway" and version "1.1"
-
Affected
Oracle
Search vendor "Oracle"
 Primavera Gateway
Search vendor "Oracle" for product "Primavera Gateway"
 14.2
Search vendor "Oracle" for product "Primavera Gateway" and version "14.2"
-
Affected
Oracle
Search vendor "Oracle"
 Primavera Gateway
Search vendor "Oracle" for product "Primavera Gateway"
 15.1
Search vendor "Oracle" for product "Primavera Gateway" and version "15.1"
-
Affected
Oracle
Search vendor "Oracle"
 Primavera Gateway
Search vendor "Oracle" for product "Primavera Gateway"
 15.2
Search vendor "Oracle" for product "Primavera Gateway" and version "15.2"
-
Affected
Oracle
Search vendor "Oracle"
 Primavera Gateway
Search vendor "Oracle" for product "Primavera Gateway"
 16.1
Search vendor "Oracle" for product "Primavera Gateway" and version "16.1"
-
Affected
Oracle
Search vendor "Oracle"
 Primavera Gateway
Search vendor "Oracle" for product "Primavera Gateway"
 16.2
Search vendor "Oracle" for product "Primavera Gateway" and version "16.2"
-
Affected