{"id":"CVE-2016-3432","description":"Unspecified vulnerability in the BI Publisher (formerly XML Publisher) component in Oracle Fusion Middleware 11.1.1.7.0 and 11.1.1.9.0 allows remote authenticated users to affect confidentiality and integrity via vectors related to Web Server.","cvssScore":5.4,"cvssVersion":"3.0","cvssVector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","cvssMetrics":[{"version":"3.0","score":5.4,"severity":"MEDIUM","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","source":"nvd@nist.gov","sourceName":"NVD","type":"Primary"},{"version":"2.0","score":4.9,"vector":"AV:N/AC:M/Au:S/C:P/I:P/A:N","source":"nvd@nist.gov","sourceName":"NVD","type":"Primary"}],"resolved":"NO-FIX-IDENTIFIED","published":"2016-07-21","lastModified":"2026-06-17","affectedProducts":[{"vendor":"oracle","product":"business intelligence publisher","version":"11.1.1.7.0"},{"vendor":"oracle","product":"business intelligence publisher","version":"11.1.1.9.0"}],"totalAffectedProducts":1,"references":[{"url":"http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html","source":"secalert_us@oracle.com","tags":["Patch","Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/91787","source":"secalert_us@oracle.com","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://www.securityfocus.com/bid/92033","source":"secalert_us@oracle.com"},{"url":"http://www.securitytracker.com/id/1036370","source":"secalert_us@oracle.com"}],"reasoning":{"decidingSource":"h2-history","decidingReason":"Manual classification assigned status: NO-FIX-IDENTIFIED","verdicts":[{"rule":"rejected","stage":"identity","outcome":"no-match"},{"rule":"armr-patch-file","stage":"scope","outcome":"no-match"},{"rule":"armr-secure-rule-file","stage":"scope","outcome":"no-match"},{"rule":"manual-classification","stage":"scope","outcome":"no-match"},{"rule":"h2-history","stage":"scope","outcome":"matched","status":"NO-FIX-IDENTIFIED","detail":"Found in legacy manual classifications","decisive":true}]},"oracleAdvisories":[{"advisory":"Oracle Critical Patch Update July 2016","releaseType":"CPU","quarter":"2016-Q3","url":"https://www.oracle.com/security-alerts/cpujul2016.html","products":[{"product":"Oracle Fusion Middleware","component":"Web Server","affectedVersions":"11.1.1.7.0, 11.1.1.9.0"}]}],"assessment":{"record":{"state":"active"},"protection":{"level":"none"},"action":{"state":"not-needed"},"review":{"state":"human","basis":"manual-review"}},"h2Comments":"## Manual Classification Context\n\n\n**Labels:** HTTP, WEB SERVER\n\n**Products:** ORACLE FUSION MIDDLEWARE, BI PUBLISHER (FORMERLY XML PUBLISHER)","signals":{"hasPOC":false,"pocCount":0},"kev":{"inKEV":false},"epss":{"available":true,"score":0.01202,"percentile":0.66532},"ssvc":{"available":true,"exploitation":"none","automatable":"no","technicalImpact":"partial"}}