vulnwire
7.5high

CVE-2017-10271KEV · ransomwarein critical feed3 exploits

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Security).

Published 9 y ago · modified 2 mo ago · JSON

CVSS
7.5
v3.1 · CNA
CISA KEV
Yes
added 2022-02-10
EPSS
100.0%
percentile 100%
Public exploits
3
Exploit-DB

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Security). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0 and 12.2.1.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

Known exploited (CISA KEV)

Added
4 y ago
Due date
2022-08-10 (4 y ago)
Ransomware use
Known to be used in ransomware campaigns
Required action
Apply updates per vendor instructions.
Vendor / product
Oracle / WebLogic Server
CISA name
Oracle Corporation WebLogic Server Remote Code Execution Vulnerability

CISA SSVC assessment

Exploitation
Active — exploited in the wild
Automatable
yes
Technical impact
partial
Assessed
4 y ago

Exploit prediction (EPSS)

99.99% probability of exploitation in the next 30 days, higher than 100% of all scored CVEs.

Exploits and detections

  • EDB-43924 Oracle WebLogic - wls-wsat Component Deserialization Remote Code Execution (Metasploit) · remote · 2018-01-29
  • EDB-43458 Oracle WebLogic < 10.3.6 - 'wls-wsat' Component Deserialisation Remote Command Execution · remote · 2018-01-03
  • EDB-43392 Oracle WebLogic Server 10.3.6.0.0 / 12.x - Remote Command Execution · remote · 2017-12-26

CVSS scores

Assigned byVersionScoreVector
CISA ADP3.17.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD3.17.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA3.17.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD2.05.0AV:N/AC:L/Au:N/C:N/I:N/A:P

Affected products

  • Oracle Corporation WebLogic Server

Classification

Weakness
  • CWE-306 Missing Authentication for Critical Functionality

References

  • exploit-db.com /exploits/43458/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
  • securitytracker.com /id/1039608 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • securityfocus.com /bid/101304 · vdb-entry, x_refsource_BID, x_transferred
  • github.com /c0mmand3rOpSec/CVE-2017-10271 · x_refsource_MISC, x_transferred
  • oracle.com /technetwork/security-advisory/cpuoct2017-3236626.html · x_refsource_CONFIRM, x_transferred
  • exploit-db.com /exploits/43924/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
  • cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-10271 · government-resource

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.