## Summary
Oracle Siebel CRM Open UI (Siebel CRM End User) contains a vulnerability affecting supported versions 17.0-26.7. A network-accessible attacker with low privileges may be able to compromise Siebel CRM End User, but successful exploitation requires human interaction from someone other than the attacker.
## Technical Details
- Affected component: Open UI within Siebel CRM End User.
- Attack vector: HTTP over the network.
- Privileges required: low privileged attacker (PR:L).
- Interaction requirement: UI:R indicates human interaction is required.
- Impact scope: S:C (scope change), meaning compromise of Siebel CRM End User may significantly impact additional products.
- Likely outcomes described by NVD:
- Unauthorized creation, deletion, or modification of critical data.
- Unauthorized access to critical data or complete access to all Siebel CRM End User accessible data.
## Affected
- Oracle Siebel CRM — Siebel CRM End User (Open UI)
- Supported affected versions: 17.0-26.7
## Impact
- Confidentiality impact: C:H (high)
- Integrity impact: I:H (high)
- Availability impact: A:N (none)
- CVSS 3.1 base score: 7.7 with vector CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
- Unauthorized access and modification of critical or all accessible Siebel CRM End User data are explicitly indicated.
## Mitigation
1. Restrict network access to Siebel CRM End User Open UI endpoints (reduce exposure over HTTP).
2. Enforce least privilege for users and service accounts to limit the practical impact of PR:L.
3. Monitor for suspicious user-driven activity consistent with UI:R exploitation attempts (e.g., unexpected actions initiated during normal user sessions).
4. Apply vendor security updates/patches for Open UI in Siebel CRM End User for versions within 17.0-26.7 (exact fixed versions not provided in the available data).
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N