{"api_version":"1","generated_at":"2026-07-23T02:53:02+00:00","cve":"CVE-2017-3501","urls":{"html":"https://cve.report/CVE-2017-3501","api":"https://cve.report/api/cve/CVE-2017-3501.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2017-3501","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2017-3501"},"summary":{"title":"CVE-2017-3501","description":"Vulnerability in the Primavera Unifier component of Oracle Primavera Products Suite (subcomponent: Platform). Supported versions that are affected are 9.13, 9.14, 10.0, 10.1, 15.1 and 15.2. Easily \"exploitable\" vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Unifier. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Primavera Unifier, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Primavera Unifier accessible data as well as unauthorized read access to a subset of Primavera Unifier accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).","state":"PUBLISHED","assigner":"oracle","published_at":"2017-04-24 19:59:02","updated_at":"2025-04-20 01:37:25"},"problem_types":["NVD-CWE-noinfo","Easily \"exploitable\" vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Unifier.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Primavera Unifier, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Primavera Unifier accessible data as well as  unauthorized read access to a subset of Primavera Unifier accessible data."],"metrics":[{"version":"3.0","source":"nvd@nist.gov","type":"Primary","score":"6.1","severity":"MEDIUM","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","data":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"}},{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"5.8","severity":"","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:P/A:N","baseScore":5.8,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html","name":"http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"],"title":"Oracle Critical Patch Update - April 2017","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securitytracker.com/id/1038289","name":"http://www.securitytracker.com/id/1038289","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Oracle Primavera Products Suite Multiple Flaws Let Remote Users Access and Modify Data and Remote Authenticated Users Deny Service and Gain Elevated Privileges - SecurityTracker","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/97895","name":"http://www.securityfocus.com/bid/97895","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"],"title":"Oracle Primavera Unifier CVE-2017-3501 Remote Security Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-3501","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-3501","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Oracle Corporation","product":"Primavera Unifier","version":"affected 9.13","platforms":[]},{"source":"CNA","vendor":"Oracle Corporation","product":"Primavera Unifier","version":"affected 9.14","platforms":[]},{"source":"CNA","vendor":"Oracle Corporation","product":"Primavera Unifier","version":"affected 10.0","platforms":[]},{"source":"CNA","vendor":"Oracle Corporation","product":"Primavera Unifier","version":"affected 10.1","platforms":[]},{"source":"CNA","vendor":"Oracle Corporation","product":"Primavera Unifier","version":"affected 15.1","platforms":[]},{"source":"CNA","vendor":"Oracle Corporation","product":"Primavera Unifier","version":"affected 15.2","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2017","cve_id":"3501","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"oracle","cpe5":"primavera_unifier","cpe6":"10.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"3501","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"oracle","cpe5":"primavera_unifier","cpe6":"10.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"3501","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"oracle","cpe5":"primavera_unifier","cpe6":"15.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"3501","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"oracle","cpe5":"primavera_unifier","cpe6":"15.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"3501","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"oracle","cpe5":"primavera_unifier","cpe6":"9.13","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"3501","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"oracle","cpe5":"primavera_unifier","cpe6":"9.14","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-05T14:30:57.397Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html"},{"name":"97895","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/97895"},{"name":"1038289","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://www.securitytracker.com/id/1038289"}],"title":"CVE Program Container"},{"metrics":[{"other":{"content":{"id":"CVE-2017-3501","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2024-10-07T15:45:17.192566Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2024-10-07T16:14:21.665Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"product":"Primavera Unifier","vendor":"Oracle Corporation","versions":[{"status":"affected","version":"9.13"},{"status":"affected","version":"9.14"},{"status":"affected","version":"10.0"},{"status":"affected","version":"10.1"},{"status":"affected","version":"15.1"},{"status":"affected","version":"15.2"}]}],"datePublic":"2017-04-18T00:00:00.000Z","descriptions":[{"lang":"en","value":"Vulnerability in the Primavera Unifier component of Oracle Primavera Products Suite (subcomponent: Platform). Supported versions that are affected are 9.13, 9.14, 10.0, 10.1, 15.1 and 15.2. Easily \"exploitable\" vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Unifier. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Primavera Unifier, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Primavera Unifier accessible data as well as unauthorized read access to a subset of Primavera Unifier accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)."}],"problemTypes":[{"descriptions":[{"description":"Easily \"exploitable\" vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Unifier.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Primavera Unifier, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Primavera Unifier accessible data as well as  unauthorized read access to a subset of Primavera Unifier accessible data.","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-07-10T09:57:01.000Z","orgId":"43595867-4340-4103-b7a2-9a5208d29a85","shortName":"oracle"},"references":[{"tags":["x_refsource_CONFIRM"],"url":"http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html"},{"name":"97895","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/97895"},{"name":"1038289","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://www.securitytracker.com/id/1038289"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"secalert_us@oracle.com","ID":"CVE-2017-3501","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Primavera Unifier","version":{"version_data":[{"version_affected":"=","version_value":"9.13"},{"version_affected":"=","version_value":"9.14"},{"version_affected":"=","version_value":"10.0"},{"version_affected":"=","version_value":"10.1"},{"version_affected":"=","version_value":"15.1"},{"version_affected":"=","version_value":"15.2"}]}}]},"vendor_name":"Oracle Corporation"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Vulnerability in the Primavera Unifier component of Oracle Primavera Products Suite (subcomponent: Platform). Supported versions that are affected are 9.13, 9.14, 10.0, 10.1, 15.1 and 15.2. Easily \"exploitable\" vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Unifier. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Primavera Unifier, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Primavera Unifier accessible data as well as unauthorized read access to a subset of Primavera Unifier accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Easily \"exploitable\" vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Unifier.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Primavera Unifier, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Primavera Unifier accessible data as well as  unauthorized read access to a subset of Primavera Unifier accessible data."}]}]},"references":{"reference_data":[{"name":"http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html","refsource":"CONFIRM","url":"http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html"},{"name":"97895","refsource":"BID","url":"http://www.securityfocus.com/bid/97895"},{"name":"1038289","refsource":"SECTRACK","url":"http://www.securitytracker.com/id/1038289"}]}}}},"cveMetadata":{"assignerOrgId":"43595867-4340-4103-b7a2-9a5208d29a85","assignerShortName":"oracle","cveId":"CVE-2017-3501","datePublished":"2017-04-24T19:00:00.000Z","dateReserved":"2016-12-06T00:00:00.000Z","dateUpdated":"2024-10-07T16:14:21.665Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2017-04-24 19:59:02","lastModifiedDate":"2025-04-20 01:37:25","problem_types":["NVD-CWE-noinfo","Easily \"exploitable\" vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Unifier.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Primavera Unifier, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Primavera Unifier accessible data as well as  unauthorized read access to a subset of Primavera Unifier accessible data."],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:P/A:N","baseScore":5.8,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":4.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:primavera_unifier:9.13:*:*:*:*:*:*:*","matchCriteriaId":"F63BF9ED-CA82-4533-9217-4215D5F0C1AC"},{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:primavera_unifier:9.14:*:*:*:*:*:*:*","matchCriteriaId":"7B2889BC-5CA8-454B-A164-316B6A3076DB"},{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:primavera_unifier:10.0:*:*:*:*:*:*:*","matchCriteriaId":"83C10D6E-A155-465F-839B-6586816ED0EF"},{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:primavera_unifier:10.1:*:*:*:*:*:*:*","matchCriteriaId":"A74DDDDD-DF1F-40FA-8712-74415AA8027B"},{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:primavera_unifier:15.1:*:*:*:*:*:*:*","matchCriteriaId":"CF8A0650-C1A5-4C5A-8F01-9243531F678F"},{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:primavera_unifier:15.2:*:*:*:*:*:*:*","matchCriteriaId":"F274A413-4666-4B62-A152-C7452C474B90"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2017","CveId":"3501","Ordinal":"1","Title":"CVE-2017-3501","CVE":"CVE-2017-3501","Year":"2017"},"notes":[{"CveYear":"2017","CveId":"3501","Ordinal":"1","NoteData":"Vulnerability in the Primavera Unifier component of Oracle Primavera Products Suite (subcomponent: Platform). Supported versions that are affected are 9.13, 9.14, 10.0, 10.1, 15.1 and 15.2. Easily \"exploitable\" vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Unifier. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Primavera Unifier, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Primavera Unifier accessible data as well as unauthorized read access to a subset of Primavera Unifier accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).","Type":"Description","Title":"CVE-2017-3501"},{"CveYear":"2017","CveId":"3501","Ordinal":"2","NoteData":"2017-04-24","Type":"Other","Title":"Published"},{"CveYear":"2017","CveId":"3501","Ordinal":"3","NoteData":"2017-07-10","Type":"Other","Title":"Modified"}]}}}