CVE-2017-3619: Vulnerability in the Automatic Service Request (ASR) component of Oracle Support Tools (subcomponent: ASR M...

Security readout for executives and security teams

Oracle Automatic Service Request (ASR) Manager versions prior to 5.7 have a confidentiality flaw. A low-privileged user already logged onto the ASR infrastructure could access critical or all ASR-accessible data. This is not a remote internet drive-by issue, but it matters where ASR stores or can reach sensitive support and infrastructure data. Exposure is limited to organizations running Oracle ASR Manager earlier than 5.7. The attacker needs low-privileged logon to the infrastructure where ASR executes, so shared administration hosts or weakly segmented management systems increase concern. Treat as a targeted confidentiality risk for Oracle support infrastructure. Prioritize if ASR Manager is still deployed below 5.7 or runs on shared management hosts. It is not KEV-listed, but the affected system may hold or reach sensitive operational data. Mitigation focus: Review Oracle April 2017 CPU guidance for ASR Manager remediation.; Upgrade or retire ASR Manager deployments prior to version 5.7.; Restrict local logon access to infrastructure where ASR executes..

Prepared

Jun 13, 2026, 05:18 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.