VRT 391,192 CVEs tracked · 15,442 in RASP scope · data as of 19 hours ago

`CVE-2016-0635`

8.8 High Out of RASP scope

Description

Unspecified vulnerability in the Enterprise Manager Ops Center component in Oracle Enterprise Manager Grid Control 12.1.4, 12.2.2, and 12.3.2; the Oracle Health Sciences Information Manager component in Oracle Health Sciences Applications 1.2.8.3, 2.0.2.3, and 3.0.1.0; the Oracle Healthcare Master Person Index component in Oracle Health Sciences Applications 2.0.12, 3.0.0, and 4.0.1; the Oracle Documaker component in Oracle Insurance Applications before 12.5; the Oracle Insurance Calculation Engine component in Oracle Insurance Applications 9.7.1, 10.1.2, and 10.2.2; the Oracle Insurance Policy Administration J2EE and Oracle Insurance Rules Palette components in Oracle Insurance Applications 9.6.1, 9.7.1, 10.0.1, 10.1.2, 10.2.0, and 10.2.2; the Oracle Retail Integration Bus component in Oracle Retail Applications 15.0; the Oracle Retail Order Broker component in Oracle Retail Applications 5.1, 5.2, and 15.0; the Primavera Contract Management component in Oracle Primavera Products Suite 14.2; the Primavera P6 Enterprise Project Portfolio Management component in Oracle Primavera Products Suite 8.2, 8.3, 8.4, 15.1, 15.2, and 16.1; the Oracle Financial Services Analytical Applications Infrastructure component in Oracle Financial Services Applications 8.0.0, 8.0.1, 8.0.2, and 8.0.3; the Oracle Commerce Guided Search / Oracle Commerce Experience Manager component in Oracle Commerce 3.1.1, 3.1.2, 11.0, 11.1, and 11.2; the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 and 9.3.5; the Oracle Communications BRM - Elastic Charging Engine 11.2.0.0.0 and 11.3.0.0.0; the Oracle Enterprise Repository Enterprise Repository 12.1.3.0.0; the Oracle Financial Services Behavior Detection Platform 8.0.1 and 8.0.2; the Oracle Hyperion Essbase 12.2.1.1; the Oracle Tuxedo System and Applications Monitor (TSAM) 11.1.1.2.0, 11.1.1.2.1, 11.1.1.2.1, 12.1.1.1.0, 12.1.3.0.0, and 12.2.2.0.0; the Oracle Communications WebRTC Session Controller component of Oracle Communications Applications (subcomponent: Security (Spring)) 7.0, 7.1 and 7.2; the Oracle Endeca Information Discovery Integrator 3.2; the Converged Commerce component of Oracle Retail Applications 16.0.1; the Oracle Identity Manager 11.1.2.3.0; Oracle Enterprise Manager for MySQL Database 12.1.0.4; Oracle Retail Invoice Matching 12.0, 13.0, 13.1, 13.2, 14.0, and 14.1; Oracle Communications Performance Intelligence Center (PIC) Software Prior to 10.2.1 and the Oracle Knowledge component of Oracle Siebel CRM (subcomponent: AnswerFlow (Spring Framework)) version 8.5.1.0 - 8.5.1.7 and 8.6.0 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors.

Exploitation Status

No public exploit

Nothing published shows this CVE being exploited, which is not the same as ruling it out. nothing published in 10 years.

CVSS E:U

CISA KEV not listed
CISA Vulnrichment exploitation: none
Indexed PoC none indexed
EPSS 5.1% chance in 30 days

Waratek Defense Posture

Out of RASP scope

A genuine Java vulnerability in a supported product that the agent cannot reach: a coverage gap, not an out-of-domain finding.

Protection none
Action not-needed none
Review human manual-review
Record active

Decided by manual classification : Manual classification of this CVE in the legacy dataset

Finding Manual classification marked OUT-OF-SCOPE but CVE matches known CPE products

CVSS

8.8 HIGH v3.0 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H 2 metrics

VRT selects the newest version's highest entry and publishes it as cvssScore, newest rather than largest because scores are not comparable across versions, and highest rather than first because the first entry is frequently a CNA placeholder scoring 0.0 over NVD's own analysis.

Version Score Band Vector Assigner Type

CVSS 3.0 8.8 HIGH CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H NVD Primary published

CVSS 2.0 9.0 no band published AV:N/AC:L/Au:S/C:C/I:C/A:C NVD Primary

Affected Software & Releases

🏛️ Oracle CPU Advisories & Products

Advisory

Type

Quarter

Products Oracle named in risk matrix

Oracle Critical Patch Update April 2019 ↗

CPU

2019-Q2

Oracle Siebel CRM / AnswerFlow (Spring Framework) (High)

Oracle Critical Patch Update January 2019 ↗

CPU

2019-Q1

Oracle Communications Applications / Security (Spring Framework) (prior to 7.0.0.1)
Oracle Sun Systems Products Suite / Software (Spring Framework) (8.4)

Oracle Critical Patch Update October 2018 ↗

CPU

2018-Q4

Oracle Communications Applications / Security (Spring Framework) (Prior to 10.2.1)

Oracle Critical Patch Update April 2018 ↗

CPU

2018-Q2

Oracle Enterprise Manager Products Suite / EM Plugin: General (Spring Framework) (12.1.0.4)
Oracle Retail Applications / Security (Spring Framework) (12.0, 13.0, 13.1, 13.2, 14.0, 14.1)

Oracle Critical Patch Update January 2018 ↗

CPU

2018-Q1

Oracle Fusion Middleware / Security (11.1.2.3.0)
Oracle Retail Applications / Foundation Data (16.0.1)

Oracle Critical Patch Update October 2017 ↗

CPU

2017-Q4

Oracle Communications Applications / Security (Spring) (7.0, 7.1, 7.2)
Oracle Fusion Middleware / Security (Spring Framework) (3.2)

Oracle Critical Patch Update July 2017 ↗

CPU

2017-Q3

Oracle Communications Applications / Elastic Charging Engine (Spring) (11.2.0.0.0, 11.3.0.0.0)
Oracle Financial Services Applications / Admin Tool (Spring) (8.0.1, 8.0.2)
Oracle Fusion Middleware / General (Spring) (11.1.1.2.0, 11.1.1.2.1, 11.1.1.2.2, 12.1.1.1.0, 12.1.3.0.0, 12.2.2.0.0)
Oracle Fusion Middleware / Security Subsystem (12.1.3.0.0)
Oracle Hyperion / Java Based Agent (Spring)

Oracle Critical Patch Update April 2017 ↗

CPU

2017-Q2

Oracle Communications Applications / Security (Spring) (7.3.0, 7.2.4)
Oracle Financial Services Applications / Core (Spring Framework) (12.0.1, 12.0.2, 12.0.3, 12.1.0)
Oracle Retail Applications / Infrastructure (14.1.3)
Oracle Retail Applications / Mobile POS (14.1.3)
Oracle Retail Applications / Security (13.2, 14.0, 14.1)
Oracle Retail Applications / Security (14.1)
Oracle Retail Applications / Security (14.1)

Oracle Critical Patch Update January 2017 ↗

CPU

2017-Q1

Oracle Communications Applications / Oracle Communications Network Intelligence (7.3.0.0)
Oracle MySQL / MySQL Enterprise Monitor (3.1.4.7895 and earlier, 3.2.1.1049 and earlier)
Oracle Retail Applications / Oracle Retail Assortment Planning (14.1, 15.0)
Oracle Retail Applications / Oracle Retail Predictive Application Server (13.1, 13.2, 13.3, 13.4, 14.0, 14.1, 15.0)

Oracle Critical Patch Update October 2016 ↗

CPU

2016-Q4

Oracle Commerce / Content Acquisition System (3.1.1, 3.1.2, 11.0, 11.1, 11.2)
Oracle Commerce / Tools and Frameworks (3.1.1, 3.1.2, 11.0, 11.1, 11.2)
Oracle Financial Services Applications / Inline Processing (8.0.0, 8.0.1, 8.0.2, 8.0.3)
Oracle Supply Chain Products Suite / Spring (9.3.4, 9.3.5)

Oracle Critical Patch Update July 2016 ↗

CPU

2016-Q3

Oracle Enterprise Manager Grid Control / Framework (12.1.4, 12.2.2, 12.3.2)
Oracle Health Sciences Applications / Health Policy Monitor (1.2.8.3, 2.0.2.3, 3.0.1.0)
Oracle Health Sciences Applications / Internal operations (2.0.12, 3.0.0, 4.0.1)
Oracle Insurance Applications / Architecture (9.6.1, 9.7.1, 10.0.1, 10.1.2, 10.2.0, 10.2.2)
Oracle Insurance Applications / Architecture (9.6.1, 9.7.1, 10.0.1, 10.1.2, 10.2.0, 10.2.2)
Oracle Insurance Applications / Architecture (9.7.1, 10.1.2, 10.2.2)
Oracle Insurance Applications / Development tools (Prior to 12.5)
Oracle Primavera Products Suite / PCM web services (14.2)
Oracle Primavera Products Suite / Web access (8.2, 8.3, 8.4, 15.1, 15.2, 16.1)
Oracle Retail Applications / Install (15.0)
Oracle Retail Applications / Order Broker Foundation (5.1, 5.2, 15.0)

Indexed Oracle Components & Versions

Family

Component

Oracle's version cell (verbatim)

Indexed as

Oracle Commerce

Content Acquisition System

3.1.1, 3.1.2, 11.0, 11.1, 11.2

3.1.1 · 3.1.2 · 11.0 · 11.1 · 11.2

Oracle Commerce

Tools and Frameworks

3.1.1, 3.1.2, 11.0, 11.1, 11.2

3.1.1 · 3.1.2 · 11.0 · 11.1 · 11.2

Oracle Communications Applications

Elastic Charging Engine (Spring)

11.2.0.0.0, 11.3.0.0.0

11.2.0.0.0 · 11.3.0.0.0

Oracle Communications Applications

Oracle Communications Network Intelligence

7.3.0.0

7.3.0.0

Oracle Communications Applications

Security (Spring Framework)

prior to 7.0.0.1

Oracle Communications Applications

Security (Spring)

7.0, 7.1, 7.2

7.0 · 7.1 · 7.2 · 7.2.4 · 7.3.0

Oracle Enterprise Manager Grid Control

Framework

12.1.4, 12.2.2, 12.3.2

12.1.4 · 12.2.2 · 12.3.2

Oracle Enterprise Manager Products Suite

EM Plugin: General (Spring Framework)

12.1.0.4

12.1.0.4

Oracle Financial Services Applications

Admin Tool (Spring)

8.0.1, 8.0.2

8.0.1 · 8.0.2

Oracle Financial Services Applications

Core (Spring Framework)

12.0.1, 12.0.2, 12.0.3, 12.1.0

12.0.1 · 12.0.2 · 12.0.3 · 12.1.0

Oracle Financial Services Applications

Inline Processing

8.0.0, 8.0.1, 8.0.2, 8.0.3

8.0.0 · 8.0.1 · 8.0.2 · 8.0.3

Oracle Fusion Middleware

General (Spring)

11.1.1.2.0, 11.1.1.2.1, 11.1.1.2.2, 12.1.1.1.0, 12.1.3.0.0, 12.2.2.0.0

11.1.1.2.0 · 11.1.1.2.1 · 11.1.1.2.2 · 12.1.1.1.0 · 12.1.3.0.0 · 12.2.2.0.0

Oracle Fusion Middleware

Security

11.1.2.3.0

11.1.2.3.0

Oracle Fusion Middleware

Security (Spring Framework)

3.2

3.2

Oracle Fusion Middleware

Security Subsystem

12.1.3.0.0

12.1.3.0.0

Oracle Health Sciences Applications

Health Policy Monitor

1.2.8.3, 2.0.2.3, 3.0.1.0

1.2.8.3 · 2.0.2.3 · 3.0.1.0

Oracle Health Sciences Applications

Internal operations

2.0.12, 3.0.0, 4.0.1

2.0.12 · 3.0.0 · 4.0.1

Oracle Hyperion

Java Based Agent (Spring)

Oracle Insurance Applications

Architecture

9.6.1, 9.7.1, 10.0.1, 10.1.2, 10.2.0, 10.2.2

9.6.1 · 9.7.1 · 10.0.1 · 10.1.2 · 10.2.0 · 10.2.2

Oracle Insurance Applications

Development tools

Prior to 12.5

MySQL Enterprise Monitor

3.1.4.7895 and earlier, 3.2.1.1049 and earlier

Oracle Primavera Products Suite

PCM web services

14.2

14.2

Oracle Primavera Products Suite

Web access

8.2, 8.3, 8.4, 15.1, 15.2, 16.1

8.2 · 8.3 · 8.4 · 15.1 · 15.2 · 16.1

Oracle Retail Applications

Foundation Data

16.0.1

16.0.1

Oracle Retail Applications

Infrastructure

14.1.3

14.1.3

Oracle Retail Applications

Install

15.0

15.0

Oracle Retail Applications

Mobile POS

14.1.3

14.1.3

Oracle Retail Applications

Oracle Retail Assortment Planning

14.1, 15.0

14.1 · 15.0

Oracle Retail Applications

Oracle Retail Predictive Application Server

13.1, 13.2, 13.3, 13.4, 14.0, 14.1, 15.0

13.1 · 13.2 · 13.3 · 13.4 · 14.0 · 14.1 · 15.0

Oracle Retail Applications

Order Broker Foundation

5.1, 5.2, 15.0

5.1 · 5.2 · 15.0

Oracle Retail Applications

Security

13.2, 14.0, 14.1

13.2 · 14.0 · 14.1

Oracle Retail Applications

Security (Spring Framework)

12.0, 13.0, 13.1, 13.2, 14.0, 14.1

12.0 · 13.0 · 13.1 · 13.2 · 14.0 · 14.1

Oracle Siebel CRM

AnswerFlow (Spring Framework)

High

Oracle Sun Systems Products Suite

Software (Spring Framework)

8.4

8.4

Oracle Supply Chain Products Suite

Spring

9.3.4, 9.3.5

9.3.4 · 9.3.5

🖥️ Product CPEs & Version Ranges

11 product(s) over 36 version claims (uncapped)

Source

Vendor

Product

Scheme

Affected Versions

nvd

oracle

generic

≤ 12.5

nvd

oracle

enterprise manager ops center

generic

12.1.4 · 12.2.2 · 12.3.2

nvd

oracle

health sciences information manager

generic

1.2.8.3 · 2.0.2.3 · 3.0.1.0

nvd

oracle

healthcare master person index

generic

2.0.12 · 3.0.0 · 4.0.1

nvd

oracle

insurance calculation engine

generic

9.7.1 · 10.1.2 · 10.2.2

nvd

oracle

insurance policy administration j2ee

generic

9.6.1 · 9.7.1 · 10.0.1 · 10.1.2 · 10.2.0 · 10.2.2

nvd

oracle

insurance rules palette

generic

9.6.1 · 9.7.1 · 10.0.1 · 10.1.2 · 10.2.0 · 10.2.2

nvd

oracle

primavera contract management

generic

14.2

nvd

oracle

primavera p6 enterprise project portfolio management

generic

8.2 · 8.3 · 8.4 · 15.1 · 15.2 · 16.1

nvd

oracle

retail integration bus

generic

15.0

nvd

oracle

retail order broker cloud service

generic

5.1 · 5.2 · 15.0

Manual classification context

A reviewer manually classified this CVE. The retained record includes the labels and products below, but not the reviewer's reasoning.

## Manual Classification Context **Labels:** ADMIN TOOL (SPRING), GENERAL (SPRING), MONITORING: GENERAL, ARCHITECTURE, TOOLS AND FRAMEWORKS, FRAMEWORK, UDP, INLINE PROCESSING, CONTENT ACQUISITION SYSTEM, DEVELOPMENT TOOLS, ELASTIC CHARGING ENGINE (SPRING), SECURITY (SPRING FRAMEWORK), OPERATIONS & MAINTENANCE, PCM WEB SERVICES, SECURITY (SPRING), SEE NOTE 1, HEALTH POLICY MONITOR, HTTP, JAVA BASED AGENT (SPRING), CORE (SPRING FRAMEWORK), MOBILE POS, INSTALL, SECURITY SUBSYSTEM, MULTIPLE, RPAS FUSION CLIENT, ORDER BROKER FOUNDATION, INFRASTRUCTURE, INTERNAL OPERATIONS, SPRING, FOUNDATION DATA, EM PLUGIN: GENERAL (SPRING FRAMEWORK), SOFTWARE (SPRING FRAMEWORK), WEB ACCESS, ANSWERFLOW (SPRING FRAMEWORK), TLS, SECURITY **Products:** ORACLE COMMUNICATIONS CONVERGED APPLICATION SERVER, ORACLE TUXEDO SYSTEM AND APPLICATIONS MONITOR, ORACLE COMMERCE, ORACLE RETAIL ASSORTMENT PLANNING, ORACLE RETAIL POINT-OF-SERVICE, ORACLE FINANCIAL SERVICES APPLICATIONS, ORACLE MYSQL, ORACLE INSURANCE POLICY ADMINISTRATION J2EE, ENTERPRISE MANAGER OPS CENTER, ORACLE FINANCIAL SERVICES ANALYTICAL APPLICATIONS INFRASTRUCTURE, TAPE LIBRARY ACSLS, ENTERPRISE MANAGER FOR MYSQL DATABASE, ORACLE INSURANCE APPLICATIONS, ORACLE FLEXCUBE PRIVATE BANKING, PRIMAVERA P6 ENTERPRISE PROJECT PORTFOLIO MANAGEMENT, PRIMAVERA CONTRACT MANAGEMENT, MYSQL ENTERPRISE MONITOR, ORACLE SIEBEL CRM, ORACLE FUSION MIDDLEWARE, ORACLE RETAIL INTEGRATION BUS, ORACLE COMMUNICATIONS NETWORK INTELLIGENCE, ORACLE DOCUMAKER, ORACLE SUN SYSTEMS PRODUCTS SUITE, HYPERION ESSBASE, ORACLE HYPERION, ORACLE SUPPLY CHAIN PRODUCTS SUITE, ORACLE PRIMAVERA PRODUCTS SUITE, ORACLE COMMUNICATIONS APPLICATIONS, ORACLE HEALTH SCIENCES APPLICATIONS, ORACLE ENTERPRISE MANAGER PRODUCTS SUITE, ORACLE COMMUNICATIONS WEBRTC SESSION CONTROLLER, ORACLE RETAIL PREDICTIVE APPLICATION SERVER, ORACLE IDENTITY MANAGER, ORACLE RETAIL RETURNS MANAGEMENT, ORACLE COMMUNICATIONS PERFORMANCE INTELLIGENCE CENTER (PIC) SOFTWARE, ORACLE ENTERPRISE MANAGER GRID CONTROL, ORACLE INSURANCE CALCULATION ENGINE, CONVERGED COMMERCE, ORACLE RETAIL APPLICATIONS, ORACLE RETAIL BACK OFFICE, ORACLE HEALTHCARE MASTER PERSON INDEX, ORACLE ENDECA INFORMATION DISCOVERY INTEGRATOR, ORACLE AGILE PLM, FINANCIAL SERVICES BEHAVIOR DETECTION PLATFORM, ORACLE COMMUNICATIONS BRM, ORACLE KNOWLEDGE, ORACLE HEALTH SCIENCES INFORMATION MANAGER, ORACLE COMMUNICATIONS NETWORK INTEGRITY, ORACLE ENTERPRISE REPOSITORY, ORACLE COMMERCE GUIDED SEARCH / ORACLE COMMERCE EXPERIENCE MANAGER, ORACLE RETAIL ORDER BROKER, ORACLE INSURANCE RULES PALETTE, ORACLE RETAIL INVOICE MATCHING

References

URL

Tags

http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html

http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html

http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html

http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html

Patch, Vendor Advisory

http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html

http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html

http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html

http://www.securityfocus.com/bid/91787

Third Party Advisory, VDB Entry

http://www.securityfocus.com/bid/91869

Timeline

Published 2016-07-21 Last modified 2026-06-17

Published

2016-07-21

By the CVE Program.

NVD record modified

2026-06-17

NVD's own last-modified date for this record.

Pipeline policy audit (5 of 21 rules evaluated)

5 of 21 rules ran. The rest were never reached, because an earlier stage settled the CVE, a distinct claim from a rule that ran and found nothing.

# Rule Outcome Status Detail

identity: Does this identifier describe a vulnerability at all? first match wins

1 rejected no-match CVE Program withdrawal of this identifier

scope: Is the vulnerability ARMR's to address? first match wins

2 armr-patch-file no-match An ARMR patch file on disk for this CVE

3 armr-secure-rule-file no-match An ARMR security-rule template on disk for this CVE

4 manual-classification no-match A researcher's recorded decision for this specific CVE

5 manual classification decided it matched Out of RASP scope Found in legacy manual classifications

6 non-java-upstream not-reached A root cause in non-Java code: an OS kernel, a C library, or a bundled runtime

7 oracle-component not-reached The defect being in a component of a tracked product the agent does not reach: JavaFX, the Java SE installer, the native WebLogic proxy plug-in. Oracle gives these no CPE of their own and names them only in the description.

8 osv-maven not-reached An OSV.dev record of this CVE affecting a package published to Maven Central

9 cna-maven-package not-reached An affected Maven artifact named by the CNA itself

10 known-cpe-product not-reached An NVD CPE naming a product ARMR tracks

11 cna-cpe-product not-reached A CPE the CNA published naming a tracked product. Oracle publishes these on advisory day, months before NVD.

12 oracle-advisory-family not-reached A tracked product family named in Oracle's own risk matrix. CPE cannot carry a suite name, only a module.

13 non-deployable-product not-reached The only affected product being a sealed appliance image, where Java runs but no -javaagent can be attached

14 unmatched-product not-reached No tracked product matched above, and none present at all

disposition: What do we do about one that is? cumulative: every rule gets a turn

15 patch-hint not-reached A reference pointing at the upstream fix: a commit, a PR, a Red Hat bug

16 open-source-maven not-reached The affected package being open source on Maven, so the fix can be read

17 poc-derivable not-reached An indexed exploit to reverse-engineer, where there is no source to read

18 no-exploit not-reached With no fix path, a public exploit, or a CISA record of one

19 secure-rule-match not-reached A vulnerability class already blocked by an ARMR security rule

20 below-action-threshold not-reached Medium or Low severity, no KEV listing, no PoC clearing the evidence bar, no CISA verdict, no Oracle advisory

21 no-exploit-published not-reached A published working exploit for this candidate, not only a proof of concept, a forecast, or nothing at all

Raw stored JSON document for this CVE ↗ · NVD ↗ · CVE.org ↗