{"id":"CVE-2017-3248","published":"2017-01-27T22:01:00Z","modified":"2025-08-13T14:25:23Z","title":"Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Core Components)","vendor":"Oracle","product":"WebLogic Server","tier":"core","eol":null,"affectedVersions":[{"vendor":"Oracle","product":"WebLogic Server","versions":["10.3.6.0","12.1.3.0","12.2.1.0","12.2.1.1"]}],"description":{"text":"Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Core Components). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.0 and 12.2.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS v3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).","provenance":"source","from":"CVE.org"},"summary":{"text":"A flaw in the Core Components subcomponent of the Oracle WebLogic Server component of Oracle Fusion Middleware allows attacks over the T3 protocol against WebLogic Server. An unauthenticated attacker with network access over T3 can take over the server, with no authentication or user interaction needed.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:15:07Z"},"cvss":null,"epss":{"score":0.97301,"percentile":0.99896,"date":"2026-10-28","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":3,"pulses":[{"name":"ripe.arin.enom.cpanel.cpcalendar.iana.networksolutions.02050.webdisk.webmail.","url":"https://otx.alienvault.com/pulse/69fdc02bea1e4ec923b01688","created":"2026-05-08"},{"name":"CVE Data","url":"https://otx.alienvault.com/pulse/69929b597293fe5837b9c95c","created":"2026-02-16"},{"name":"Click It Up: Targeting Local Government Payment Portals","url":"https://otx.alienvault.com/pulse/5ba28e5465d7661540cdd823","created":"2018-09-19"}],"provenance":"machine"},"cwes":[],"references":[{"url":"https://www.exploit-db.com/exploits/44998/","tags":["exploit","x_refsource_EXPLOIT-DB"]},{"url":"https://www.tenable.com/security/research/tra-2017-07","tags":["x_refsource_MISC"]},{"url":"http://www.securityfocus.com/bid/95465","tags":["vdb-entry","x_refsource_BID"]},{"url":"http://www.securitytracker.com/id/1037632","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujan2017-2881727.html","tags":["x_refsource_CONFIRM"]},{"url":"http://packetstormsecurity.com/files/152357/Oracle-Weblogic-Server-Deserialization-RMI-UnicastRef-Remote-Code-Execution.html","tags":["x_refsource_MISC"]},{"url":"https://www.vicarius.io/vsociety/posts/cve-2017-3248-detect-centos-weblogic-rce","tags":[]},{"url":"https://www.vicarius.io/vsociety/posts/cve-2017-3248-mitigate-centos-weblogic-rce","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2017-12369","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-12369","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[{"id":44998,"url":"https://www.exploit-db.com/exploits/44998","title":"Oracle WebLogic 12.1.2.0 - RMI Registry UnicastRef Object Java Deserialization Remote Code Execution","type":"webapps","platform":"multiple","date":"2018-07-07","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2018-07-07"},"pocGithub":{"count":2,"skipped":1,"earliest":"2019-11-05","earliestUrl":"https://github.com/ianxtianxt/CVE-2017-3248","repos":[{"name":"daybreak-kits/weblogicScanner","url":"https://github.com/daybreak-kits/weblogicScanner","stars":2081,"created":"2020-01-15"},{"name":"ianxtianxt/CVE-2017-3248","url":"https://github.com/ianxtianxt/CVE-2017-3248","stars":0,"created":"2019-11-05"}]},"metasploit":[{"name":"Oracle Weblogic Server Deserialization RCE - RMI UnicastRef","module":"exploit/multi/misc/weblogic_deserialize_unicastref","type":"exploit","disclosureDate":"2017-01-25","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/misc/weblogic_deserialize_unicastref.rb"}],"first":{"date":"2017-01-25","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/misc/weblogic_deserialize_unicastref.rb"},"provenance":"source"},"exploitRefs":["https://www.exploit-db.com/exploits/44998/","http://packetstormsecurity.com/files/152357/Oracle-Weblogic-Server-Deserialization-RMI-UnicastRef-Remote-Code-Execution.html"],"flow":[],"timeline":[{"date":"2017-01-25","kind":"exploit-public","label":"First public exploit: Metasploit; later: Exploit-DB 2018-07-07, PoC-in-GitHub 2019-11-05","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/misc/weblogic_deserialize_unicastref.rb","provenance":"source"},{"date":"2017-01-27","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2017-3248","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":null},"priority":{"score":26.3,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.98,"detail":"percentile 0.9990"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 1 Exploit-DB entry; 1 NVD exploit link; 2 PoC-in-GitHub repos; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":1.37,"detail":"3 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}