CVE-2017-3489: Vulnerability in the Oracle FLEXCUBE Investor Servicing component of Oracle Financial Services Applications...

Security readout for executives and security teams

CVE-2017-3489 affects Oracle FLEXCUBE Investor Servicing. A low-privileged user with HTTP network access could read some data and change some records. The issue is business-relevant for financial services environments because it can undermine data confidentiality and integrity, although the source bundle does not indicate service outage impact or active exploitation. Exposure is most likely where Oracle FLEXCUBE Investor Servicing versions 12.0.1, 12.0.2, 12.0.3, 12.0.4, 12.1.0, 12.2.0, or 12.3.0 are reachable over HTTP by low-privileged users. Internet exposure is not stated in the sources and should not be assumed. Treat this as a moderate-priority financial application integrity issue. It should be remediated in normal vulnerability management timelines, faster if the affected FLEXCUBE service is broadly reachable or supports sensitive investor servicing workflows. Mitigation focus: Check Oracle April 2017 CPU guidance for the applicable FLEXCUBE fix.; Upgrade or patch affected FLEXCUBE Investor Servicing versions per Oracle instructions.; Restrict HTTP access to trusted networks and required user groups..

Prepared

Jun 13, 2026, 05:18 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.