Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2017-3248 — Oracle Weblogic Server vulnerability

7 documents7 sources
Severity
9.8CRITICALNVD
OSV6.2
EPSS
91.2%
top 0.35%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
2
PuppetOracle Weblogic Server
Timeline
PublishedJan 27
Latest updateMay 14

Description

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Core Components). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.0 and 12.2.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS v3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages3 packages

▶CVEListV5oracle/weblogic_server4 versions+3
▶NVDoracle/weblogic_server4 versions+3
▶Ubuntupuppet/puppet< 3.4.3-1ubuntu1.2

Patches

Patch: www.oracle.com ↗Patch: www.oracle.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-j377-ff8h-jf66: Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Core Components)↗2022-05-14
▶
OSV
puppet vulnerabilities↗2017-06-05
▶
CVEList
CVE-2017-3248: Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Core Components)↗2017-01-27
▶

💥Exploits & PoCs

2
Exploit-DB
Oracle WebLogic 12.1.2.0 - RMI Registry UnicastRef Object Java Deserialization Remote Code Execution↗2018-07-07
▶
Metasploit
Oracle Weblogic Server Deserialization RCE - RMI UnicastRef↗
▶

💬Community

1
Bugzilla
CVE-2017-11770 .NET Core: DoS via bad certificate↗2017-11-14
▶
CVE-2017-3248 — Oracle Weblogic Server vulnerability | cvebase