CVE-2017-3254 is a high-severity vulnerability affecting Oracle Retail Invoice Matching versions 12.0 and 13.0, specifically within its Security subcomponent. An unauthenticated attacker can exploit this vulnerability remotely via HTTP, requiring user interaction to achieve successful compromise. This can lead to unauthorized access to critical data, partial data modification, and a partial denial of service. The vulnerability has a CVSS 3.0 Base Score of 7.6, indicating high impact on confidentiality, and moderate impact on integrity and availability. Its attack vector is network-based with low attack complexity, but user interaction is required. Currently, there is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. Community discussion and media coverage for this CVE are minimal.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
12.0CPE matchmatch criteria | cpe:2.3:a:oracle:retail_invoice_matching:12.0:*:*:*:*:*:*:* | ||
13.0CPE matchmatch criteria | cpe:2.3:a:oracle:retail_invoice_matching:13.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.1 Security Researcher mentions.