CVE-2017-3237: Vulnerability in the Automatic Service Request (ASR) component of Oracle Support Tools (subcomponent: ASR M...

Security readout for executives and security teams

CVE-2017-3237 lets a low-privileged user who can log on to the system running Oracle Automatic Service Request compromise ASR Manager. A successful attack can fully take over that ASR component, affecting confidentiality, integrity, and availability. Exposure is limited to organizations running Oracle Automatic Service Request ASR Manager prior to 5.7. The attacker needs low-privileged logon access to the infrastructure where ASR executes, so risk concentrates on shared administration hosts and compromised internal accounts. Treat this as a high-priority internal exposure issue if Oracle ASR Manager is present. It is less urgent than an internet-facing unauthenticated flaw, but local compromise could lead to full ASR takeover. Mitigation focus: Identify all Oracle ASR Manager deployments and record installed versions.; Upgrade ASR Manager installations prior to 5.7 using Oracle guidance.; Restrict logon access to infrastructure where ASR executes..

Prepared

Jun 13, 2026, 05:18 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.