WaratekVRT Sign in

CVE-2016-0635

Affected software7 products, listed below
Affected versions12.1.4, 12.2.2, 12.3.2
Severity8.8 High CVSS 3.0 2 scores
Fixed inOracle Critical Patch Update July 2016
Published21 Jul 2016
Updated17 Jun 2026

Description

Unspecified vulnerability in the Enterprise Manager Ops Center component in Oracle Enterprise Manager Grid Control 12.1.4, 12.2.2, and 12.3.2; the Oracle Health Sciences Information Manager component in Oracle Health Sciences Applications 1.2.8.3, 2.0.2.3, and 3.0.1.0; the Oracle Healthcare Master Person Index component in Oracle Health Sciences Applications 2.0.12, 3.0.0, and 4.0.1; the Oracle Documaker component in Oracle Insurance Applications before 12.5; the Oracle Insurance Calculation Engine component in Oracle Insurance Applications 9.7.1, 10.1.2, and 10.2.2; the Oracle Insurance Policy Administration J2EE and Oracle Insurance Rules Palette components in Oracle Insurance Applications 9.6.1, 9.7.1, 10.0.1, 10.1.2, 10.2.0, and 10.2.2; the Oracle Retail Integration Bus component in Oracle Retail Applications 15.0; the Oracle Retail Order Broker component in Oracle Retail Applications 5.1, 5.2, and 15.0; the Primavera Contract Management component in Oracle Primavera Products Suite 14.2; the Primavera P6 Enterprise Project Portfolio Management component in Oracle Primavera Products Suite 8.2, 8.3, 8.4, 15.1, 15.2, and 16.1; the Oracle Financial Services Analytical Applications Infrastructure component in Oracle Financial Services Applications 8.0.0, 8.0.1, 8.0.2, and 8.0.3; the Oracle Commerce Guided Search / Oracle Commerce Experience Manager component in Oracle Commerce 3.1.1, 3.1.2, 11.0, 11.1, and 11.2; the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 and 9.3.5; the Oracle Communications BRM - Elastic Charging Engine 11.2.0.0.0 and 11.3.0.0.0; the Oracle Enterprise Repository Enterprise Repository 12.1.3.0.0; the Oracle Financial Services Behavior Detection Platform 8.0.1 and 8.0.2; the Oracle Hyperion Essbase 12.2.1.1; the Oracle Tuxedo System and Applications Monitor (TSAM) 11.1.1.2.0, 11.1.1.2.1, 11.1.1.2.1, 12.1.1.1.0, 12.1.3.0.0, and 12.2.2.0.0; the Oracle Communications WebRTC Session Controller component of Oracle Communications Applications (subcomponent: Security (Spring)) 7.0, 7.1 and 7.2; the Oracle Endeca Information Discovery Integrator 3.2; the Converged Commerce component of Oracle Retail Applications 16.0.1; the Oracle Identity Manager 11.1.2.3.0; Oracle Enterprise Manager for MySQL Database 12.1.0.4; Oracle Retail Invoice Matching 12.0, 13.0, 13.1, 13.2, 14.0, and 14.1; Oracle Communications Performance Intelligence Center (PIC) Software Prior to 10.2.1 and the Oracle Knowledge component of Oracle Siebel CRM (subcomponent: AnswerFlow (Spring Framework)) version 8.5.1.0 - 8.5.1.7 and 8.6.0 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors.

Exploitation status

No public exploit

No exploit has been reported in the sources we check. Published 10 years ago.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment exploitation: none
  • Indexed PoC none indexed
  • EPSS 5.1% chance in 30 days

Waratek protection

Outside Waratek scope

A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.

  • Protection none
  • Action not pursued none
  • Review human Researcher
  • Record active
Decided by Manual classification of this CVE in the legacy dataset
Finding A manual classification set this CVE's status to Outside Waratek scope, but the CVE names a tracked product.

CVSS

8.8 HIGH v3.0 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.0 8.8 HIGH CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H NVD Primary published
CVSS 2.0 9.0 none AV:N/AC:L/Au:S/C:C/I:C/A:C NVD Primary

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update April 2019 ↗ CPU 2019-Q2 Oracle Siebel CRM / AnswerFlow (Spring Framework) (High)
Oracle Critical Patch Update January 2019 ↗ CPU 2019-Q1 Oracle Communications Applications / Security (Spring Framework) (prior to 7.0.0.1)
Oracle Sun Systems Products Suite / Software (Spring Framework) (8.4)
Oracle Critical Patch Update October 2018 ↗ CPU 2018-Q4 Oracle Communications Applications / Security (Spring Framework) (Prior to 10.2.1)
Oracle Critical Patch Update April 2018 ↗ CPU 2018-Q2 Oracle Enterprise Manager Products Suite / EM Plugin: General (Spring Framework) (12.1.0.4)
Oracle Retail Applications / Security (Spring Framework) (12.0, 13.0, 13.1, 13.2, 14.0, 14.1)
Oracle Critical Patch Update January 2018 ↗ CPU 2018-Q1 Oracle Fusion Middleware / Security (11.1.2.3.0)
Oracle Retail Applications / Foundation Data (16.0.1)
Oracle Critical Patch Update October 2017 ↗ CPU 2017-Q4 Oracle Communications Applications / Security (Spring) (7.0, 7.1, 7.2)
Oracle Fusion Middleware / Security (Spring Framework) (3.2)
Oracle Critical Patch Update July 2017 ↗ CPU 2017-Q3 Oracle Communications Applications / Elastic Charging Engine (Spring) (11.2.0.0.0, 11.3.0.0.0)
Oracle Financial Services Applications / Admin Tool (Spring) (8.0.1, 8.0.2)
Oracle Fusion Middleware / General (Spring) (11.1.1.2.0, 11.1.1.2.1, 11.1.1.2.2, 12.1.1.1.0, 12.1.3.0.0, 12.2.2.0.0)
Oracle Fusion Middleware / Security Subsystem (12.1.3.0.0)
Oracle Hyperion / Java Based Agent (Spring)
Oracle's note: Fixed in all versions from 12.2.1.1 onward.
Oracle Critical Patch Update April 2017 ↗ CPU 2017-Q2 Oracle Communications Applications / Security (Spring) (7.3.0, 7.2.4)
Oracle Financial Services Applications / Core (Spring Framework) (12.0.1, 12.0.2, 12.0.3, 12.1.0)
Oracle Retail Applications / Infrastructure (14.1.3)
Oracle Retail Applications / Mobile POS (14.1.3)
Oracle Retail Applications / Security (13.2, 14.0, 14.1)
Oracle Retail Applications / Security (14.1)
Oracle Retail Applications / Security (14.1)
Oracle Critical Patch Update January 2017 ↗ CPU 2017-Q1 Oracle Communications Applications / Oracle Communications Network Intelligence (7.3.0.0)
Oracle MySQL / MySQL Enterprise Monitor (3.1.4.7895 and earlier, 3.2.1.1049 and earlier)
Oracle Retail Applications / Oracle Retail Assortment Planning (14.1, 15.0)
Oracle Retail Applications / Oracle Retail Predictive Application Server (13.1, 13.2, 13.3, 13.4, 14.0, 14.1, 15.0)
Oracle Critical Patch Update October 2016 ↗ CPU 2016-Q4 Oracle Commerce / Content Acquisition System (3.1.1, 3.1.2, 11.0, 11.1, 11.2)
Oracle Commerce / Tools and Frameworks (3.1.1, 3.1.2, 11.0, 11.1, 11.2)
Oracle Financial Services Applications / Inline Processing (8.0.0, 8.0.1, 8.0.2, 8.0.3)
Oracle Supply Chain Products Suite / Spring (9.3.4, 9.3.5)
Oracle Critical Patch Update July 2016 ↗ CPU 2016-Q3 Oracle Enterprise Manager Grid Control / Framework (12.1.4, 12.2.2, 12.3.2)
Oracle Health Sciences Applications / Health Policy Monitor (1.2.8.3, 2.0.2.3, 3.0.1.0)
Oracle Health Sciences Applications / Internal operations (2.0.12, 3.0.0, 4.0.1)
Oracle Insurance Applications / Architecture (9.6.1, 9.7.1, 10.0.1, 10.1.2, 10.2.0, 10.2.2)
Oracle Insurance Applications / Architecture (9.6.1, 9.7.1, 10.0.1, 10.1.2, 10.2.0, 10.2.2)
Oracle Insurance Applications / Architecture (9.7.1, 10.1.2, 10.2.2)
Oracle Insurance Applications / Development tools (Prior to 12.5)
Oracle Primavera Products Suite / PCM web services (14.2)
Oracle Primavera Products Suite / Web access (8.2, 8.3, 8.4, 15.1, 15.2, 16.1)
Oracle Retail Applications / Install (15.0)
Oracle Retail Applications / Order Broker Foundation (5.1, 5.2, 15.0)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Commerce Content Acquisition System 3.1.1, 3.1.2, 11.0, 11.1, 11.2 3.1.1 · 3.1.2 · 11.0 · 11.1 · 11.2
Oracle Commerce Tools and Frameworks 3.1.1, 3.1.2, 11.0, 11.1, 11.2 3.1.1 · 3.1.2 · 11.0 · 11.1 · 11.2
Oracle Communications Applications Elastic Charging Engine (Spring) 11.2.0.0.0, 11.3.0.0.0 11.2.0.0.0 · 11.3.0.0.0
Oracle Communications Applications Oracle Communications Network Intelligence 7.3.0.0 7.3.0.0
Oracle Communications Applications Security (Spring Framework) prior to 7.0.0.1
Oracle Communications Applications Security (Spring) 7.0, 7.1, 7.2 7.0 · 7.1 · 7.2 · 7.2.4 · 7.3.0
Oracle Enterprise Manager Grid Control Framework 12.1.4, 12.2.2, 12.3.2 12.1.4 · 12.2.2 · 12.3.2
Oracle Enterprise Manager Products Suite EM Plugin: General (Spring Framework) 12.1.0.4 12.1.0.4
Oracle Financial Services Applications Admin Tool (Spring) 8.0.1, 8.0.2 8.0.1 · 8.0.2
Oracle Financial Services Applications Core (Spring Framework) 12.0.1, 12.0.2, 12.0.3, 12.1.0 12.0.1 · 12.0.2 · 12.0.3 · 12.1.0
Oracle Financial Services Applications Inline Processing 8.0.0, 8.0.1, 8.0.2, 8.0.3 8.0.0 · 8.0.1 · 8.0.2 · 8.0.3
Oracle Fusion Middleware General (Spring) 11.1.1.2.0, 11.1.1.2.1, 11.1.1.2.2, 12.1.1.1.0, 12.1.3.0.0, 12.2.2.0.0 11.1.1.2.0 · 11.1.1.2.1 · 11.1.1.2.2 · 12.1.1.1.0 · 12.1.3.0.0 · 12.2.2.0.0
Oracle Fusion Middleware Security 11.1.2.3.0 11.1.2.3.0
Oracle Fusion Middleware Security (Spring Framework) 3.2 3.2
Oracle Fusion Middleware Security Subsystem 12.1.3.0.0 12.1.3.0.0
Oracle Health Sciences Applications Health Policy Monitor 1.2.8.3, 2.0.2.3, 3.0.1.0 1.2.8.3 · 2.0.2.3 · 3.0.1.0
Oracle Health Sciences Applications Internal operations 2.0.12, 3.0.0, 4.0.1 2.0.12 · 3.0.0 · 4.0.1
Oracle Hyperion Java Based Agent (Spring)
Oracle Insurance Applications Architecture 9.6.1, 9.7.1, 10.0.1, 10.1.2, 10.2.0, 10.2.2 9.6.1 · 9.7.1 · 10.0.1 · 10.1.2 · 10.2.0 · 10.2.2
Oracle Insurance Applications Development tools Prior to 12.5
Oracle MySQL MySQL Enterprise Monitor 3.1.4.7895 and earlier, 3.2.1.1049 and earlier
Oracle Primavera Products Suite PCM web services 14.2 14.2
Oracle Primavera Products Suite Web access 8.2, 8.3, 8.4, 15.1, 15.2, 16.1 8.2 · 8.3 · 8.4 · 15.1 · 15.2 · 16.1
Oracle Retail Applications Foundation Data 16.0.1 16.0.1
Oracle Retail Applications Infrastructure 14.1.3 14.1.3
Oracle Retail Applications Install 15.0 15.0
Oracle Retail Applications Mobile POS 14.1.3 14.1.3
Oracle Retail Applications Oracle Retail Assortment Planning 14.1, 15.0 14.1 · 15.0
Oracle Retail Applications Oracle Retail Predictive Application Server 13.1, 13.2, 13.3, 13.4, 14.0, 14.1, 15.0 13.1 · 13.2 · 13.3 · 13.4 · 14.0 · 14.1 · 15.0
Oracle Retail Applications Order Broker Foundation 5.1, 5.2, 15.0 5.1 · 5.2 · 15.0
Oracle Retail Applications Security 13.2, 14.0, 14.1 13.2 · 14.0 · 14.1
Oracle Retail Applications Security (Spring Framework) 12.0, 13.0, 13.1, 13.2, 14.0, 14.1 12.0 · 13.0 · 13.1 · 13.2 · 14.0 · 14.1
Oracle Siebel CRM AnswerFlow (Spring Framework) High
Oracle Sun Systems Products Suite Software (Spring Framework) 8.4 8.4
Oracle Supply Chain Products Suite Spring 9.3.4, 9.3.5 9.3.4 · 9.3.5

Products and versions

11 products, 36 version entries
SourceVendorProductSchemeAffected versions
nvd oracle documaker generic ≤ 12.5
nvd oracle enterprise manager ops center generic 12.1.4 · 12.2.2 · 12.3.2
nvd oracle health sciences information manager generic 1.2.8.3 · 2.0.2.3 · 3.0.1.0
nvd oracle healthcare master person index generic 2.0.12 · 3.0.0 · 4.0.1
nvd oracle insurance calculation engine generic 9.7.1 · 10.1.2 · 10.2.2
nvd oracle insurance policy administration j2ee generic 9.6.1 · 9.7.1 · 10.0.1 · 10.1.2 · 10.2.0 · 10.2.2
nvd oracle insurance rules palette generic 9.6.1 · 9.7.1 · 10.0.1 · 10.1.2 · 10.2.0 · 10.2.2
nvd oracle primavera contract management generic 14.2
nvd oracle primavera p6 enterprise project portfolio management generic 8.2 · 8.3 · 8.4 · 15.1 · 15.2 · 16.1
nvd oracle retail integration bus generic 15.0
nvd oracle retail order broker cloud service generic 5.1 · 5.2 · 15.0

Earlier manual review

A reviewer classified this CVE in an older dataset. We kept the labels and products below, but not the reviewer's reasoning.

## Manual Classification Context **Labels:** ADMIN TOOL (SPRING), GENERAL (SPRING), MONITORING: GENERAL, ARCHITECTURE, TOOLS AND FRAMEWORKS, FRAMEWORK, UDP, INLINE PROCESSING, CONTENT ACQUISITION SYSTEM, DEVELOPMENT TOOLS, ELASTIC CHARGING ENGINE (SPRING), SECURITY (SPRING FRAMEWORK), OPERATIONS & MAINTENANCE, PCM WEB SERVICES, SECURITY (SPRING), SEE NOTE 1, HEALTH POLICY MONITOR, HTTP, JAVA BASED AGENT (SPRING), CORE (SPRING FRAMEWORK), MOBILE POS, INSTALL, SECURITY SUBSYSTEM, MULTIPLE, RPAS FUSION CLIENT, ORDER BROKER FOUNDATION, INFRASTRUCTURE, INTERNAL OPERATIONS, SPRING, FOUNDATION DATA, EM PLUGIN: GENERAL (SPRING FRAMEWORK), SOFTWARE (SPRING FRAMEWORK), WEB ACCESS, ANSWERFLOW (SPRING FRAMEWORK), TLS, SECURITY **Products:** ORACLE COMMUNICATIONS CONVERGED APPLICATION SERVER, ORACLE TUXEDO SYSTEM AND APPLICATIONS MONITOR, ORACLE COMMERCE, ORACLE RETAIL ASSORTMENT PLANNING, ORACLE RETAIL POINT-OF-SERVICE, ORACLE FINANCIAL SERVICES APPLICATIONS, ORACLE MYSQL, ORACLE INSURANCE POLICY ADMINISTRATION J2EE, ENTERPRISE MANAGER OPS CENTER, ORACLE FINANCIAL SERVICES ANALYTICAL APPLICATIONS INFRASTRUCTURE, TAPE LIBRARY ACSLS, ENTERPRISE MANAGER FOR MYSQL DATABASE, ORACLE INSURANCE APPLICATIONS, ORACLE FLEXCUBE PRIVATE BANKING, PRIMAVERA P6 ENTERPRISE PROJECT PORTFOLIO MANAGEMENT, PRIMAVERA CONTRACT MANAGEMENT, MYSQL ENTERPRISE MONITOR, ORACLE SIEBEL CRM, ORACLE FUSION MIDDLEWARE, ORACLE RETAIL INTEGRATION BUS, ORACLE COMMUNICATIONS NETWORK INTELLIGENCE, ORACLE DOCUMAKER, ORACLE SUN SYSTEMS PRODUCTS SUITE, HYPERION ESSBASE, ORACLE HYPERION, ORACLE SUPPLY CHAIN PRODUCTS SUITE, ORACLE PRIMAVERA PRODUCTS SUITE, ORACLE COMMUNICATIONS APPLICATIONS, ORACLE HEALTH SCIENCES APPLICATIONS, ORACLE ENTERPRISE MANAGER PRODUCTS SUITE, ORACLE COMMUNICATIONS WEBRTC SESSION CONTROLLER, ORACLE RETAIL PREDICTIVE APPLICATION SERVER, ORACLE IDENTITY MANAGER, ORACLE RETAIL RETURNS MANAGEMENT, ORACLE COMMUNICATIONS PERFORMANCE INTELLIGENCE CENTER (PIC) SOFTWARE, ORACLE ENTERPRISE MANAGER GRID CONTROL, ORACLE INSURANCE CALCULATION ENGINE, CONVERGED COMMERCE, ORACLE RETAIL APPLICATIONS, ORACLE RETAIL BACK OFFICE, ORACLE HEALTHCARE MASTER PERSON INDEX, ORACLE ENDECA INFORMATION DISCOVERY INTEGRATOR, ORACLE AGILE PLM, FINANCIAL SERVICES BEHAVIOR DETECTION PLATFORM, ORACLE COMMUNICATIONS BRM, ORACLE KNOWLEDGE, ORACLE HEALTH SCIENCES INFORMATION MANAGER, ORACLE COMMUNICATIONS NETWORK INTEGRITY, ORACLE ENTERPRISE REPOSITORY, ORACLE COMMERCE GUIDED SEARCH / ORACLE COMMERCE EXPERIENCE MANAGER, ORACLE RETAIL ORDER BROKER, ORACLE INSURANCE RULES PALETTE, ORACLE RETAIL INVOICE MATCHING

References

URLTags
http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html
http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html Patch, Vendor Advisory
http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
http://www.securityfocus.com/bid/91787 Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/91869

Timeline
Published2016-07-21By the CVE Program.
NVD record modified2026-06-17NVD's own last-modified date for this record.