CVE-2017-3232: Vulnerability in the Automatic Service Request (ASR) component of Oracle Support Tools (subcomponent: ASR M...

Security readout for executives and security teams

CVE-2017-3232 affects Oracle Automatic Service Request (ASR) Manager before 5.7. A logged-in low-privilege user on the ASR infrastructure could access critical ASR data. The issue is local, not remotely unauthenticated, but matters where ASR holds support, system, or service data. Exposure is limited to organizations running Oracle ASR Manager before 5.7, especially where lower-privileged users can log on to the infrastructure where ASR executes. The provided sources do not identify specific platforms, configurations, or deployment patterns beyond ASR Manager. Prioritize remediation where ASR Manager is deployed on shared infrastructure or where sensitive operational data is accessible through ASR. This is not evidenced as actively exploited, but the confidentiality impact is high and the prerequisite is only low-privileged local access. Mitigation focus: Confirm whether Oracle ASR Manager is deployed and record its version.; Upgrade ASR Manager to 5.7 or later, following Oracle guidance.; Restrict logon access to ASR infrastructure to required administrators only..

Prepared

Jun 13, 2026, 05:18 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.