{"id":"CVE-2018-2893","published":"2018-07-18T13:00:00Z","modified":"2024-10-02T20:21:36Z","title":"Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components)","vendor":"Oracle Corporation","product":"WebLogic Server","tier":"core","eol":null,"affectedVersions":[{"vendor":"Oracle Corporation","product":"WebLogic Server","versions":["10.3.6.0","12.1.3.0","12.2.1.2","12.2.1.3"]}],"description":{"text":"Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.2 and 12.2.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","provenance":"source","from":"CVE.org"},"summary":{"text":"The flaw lies in the WLS Core Components subcomponent of the Oracle WebLogic Server component within Oracle Fusion Middleware, affecting WebLogic Server in the supported versions listed for the product. An unauthenticated attacker with network access via the T3 protocol can easily exploit it, requiring no user interaction or configuration, and successful exploitation can result in takeover of the WebLogic Server.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:16:55Z"},"cvss":null,"epss":{"score":0.70319,"percentile":0.99383,"date":"2026-10-28","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2018-07-20","exploitedFirstSeen":"2018-07-20","ransomware":false,"evidence":[{"url":"https://isc.sans.edu/diary/Weblogic+Exploit+Code+Made+Public+CVE20182893/23896","date":"2018-07-20"}],"evidenceTotal":1,"provenance":"source"},"exploited":true,"otx":{"pulseCount":12,"pulses":[{"name":"ripe.arin.enom.cpanel.cpcalendar.iana.networksolutions.02050.webdisk.webmail.","url":"https://otx.alienvault.com/pulse/69fdc02bea1e4ec923b01688","created":"2026-05-08"},{"name":"Spam “Broken Seal” DocuSign-themed Delivery w/Fileless Process Hollowing (Zeppelin/Bloat-A) by msudosos","url":"https://otx.alienvault.com/pulse/69bf64eccb5d39a90a3c391e","created":"2026-03-22"},{"name":"Spam “Broken Seal” DocuSign-themed Delivery w/Fileless Process Hollowing (Zeppelin/Bloat-A) by msudosos","url":"https://otx.alienvault.com/pulse/69bf64e1d5e06aa6207f78de","created":"2026-03-22"},{"name":"CVE Data","url":"https://otx.alienvault.com/pulse/69929b597293fe5837b9c95c","created":"2026-02-16"},{"name":"“Broken Seal” DocuSign-themed Delivery with Fileless Process Hollowing (Zeppelin/Bloat-A)","url":"https://otx.alienvault.com/pulse/698e93e1ab02db8c49e8c3ed","created":"2026-02-13"},{"name":"Double Umbrella AS15169/AS21928: This evaluates a critical structural convergence between Google (AS15169) and T-Mobile USA (AS21928) within the global Tier-1 routing backbone","url":"https://otx.alienvault.com/pulse/698d30c03b57c38dff915023","created":"2026-02-12"},{"name":"invoke-mimikatz.hasthe.technology","url":"https://otx.alienvault.com/pulse/676af0f2663cdd2f25ed9e80","created":"2024-12-24"},{"name":"rogers","url":"https://otx.alienvault.com/pulse/64ab46ec79ba3a3f9f859541","created":"2023-07-09"},{"name":"rogers","url":"https://otx.alienvault.com/pulse/64ab412e96e4858e508978c7","created":"2023-07-09"},{"name":"Log4j","url":"https://otx.alienvault.com/pulse/61df005d9f0ff216afd15bdc","created":"2022-01-12"}],"provenance":"machine"},"cwes":[],"references":[{"url":"http://www.securitytracker.com/id/1041301","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","tags":["x_refsource_CONFIRM"]},{"url":"http://www.securityfocus.com/bid/104763","tags":["vdb-entry","x_refsource_BID"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 1)","mappingType":"uncategorized","evidence":[],"confidence":"low","confidenceNote":"CTID attack_to_cve Phase 1 \"Uncategorized\" mapping (not staged by impact)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2018-14748","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-14748","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":7,"skipped":0,"earliest":"2018-07-19","earliestUrl":"https://github.com/Draven996/CVE-2018-2893","repos":[{"name":"pyn3rd/CVE-2018-2893","url":"https://github.com/pyn3rd/CVE-2018-2893","stars":105,"created":"2018-07-22"},{"name":"qianl0ng/CVE-2018-2893","url":"https://github.com/qianl0ng/CVE-2018-2893","stars":47,"created":"2018-07-26"},{"name":"bigsizeme/CVE-2018-2893","url":"https://github.com/bigsizeme/CVE-2018-2893","stars":17,"created":"2018-07-20"},{"name":"jas502n/CVE-2018-2893","url":"https://github.com/jas502n/CVE-2018-2893","stars":13,"created":"2018-10-07"},{"name":"Draven996/CVE-2018-2893","url":"https://github.com/Draven996/CVE-2018-2893","stars":0,"created":"2018-07-19"}]},"nuclei":[{"id":"CVE-2018-2893","name":"Oracle WebLogic Server - Remote Code Execution","severity":"critical","path":"network/cves/2018/CVE-2018-2893.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2018/CVE-2018-2893.yaml"}],"first":{"date":"2018-07-19","source":"PoC-in-GitHub","url":"https://github.com/Draven996/CVE-2018-2893"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"related","techniques":["T1190"],"provenance":"source","lowConfidence":true}],"timeline":[{"date":"2018-07-18","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2018-2893","provenance":"source"},{"date":"2018-07-19","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/Draven996/CVE-2018-2893","provenance":"source"},{"date":"2018-07-20","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://isc.sans.edu/diary/Weblogic+Exploit+Code+Made+Public+CVE20182893/23896","provenance":"source"}],"speed":{"daysToPublicExploit":1,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":62.4,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 3023 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.88,"detail":"percentile 0.9938"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"7 PoC-in-GitHub repos; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":2.53,"detail":"12 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}