Patchfirst
Patchfirst
CVE-2018-2893 Public exploit EPSS 70.3%

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components)

Oracle Corporation · WebLogic Server

Summary

The flaw lies in the WLS Core Components subcomponent of the Oracle WebLogic Server component within Oracle Fusion Middleware, affecting WebLogic Server in the supported versions listed for the product. An unauthenticated attacker with network access via the T3 protocol can easily exploit it, requiring no user interaction or configuration, and successful exploitation can result in takeover of the WebLogic Server.

Official description · CVE.org

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.2 and 12.2.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Breakdown
62.4 / 100
Exploited
Yes, in VulnCheck KEV
Reports
0
Tactics
0/15

First seen exploited 2 days after disclosure. Public exploit code (PoC-in-GitHub) appeared 1 day after disclosure.

  1. Disclosedday 0
  2. Public exploit codePoC-in-GitHub+1 day
  3. First seen exploitedVulnCheck KEV evidence+2 days

techniques

No techniques linked

No high- or medium-confidence techniques. The 1 available link are lower confidence and listed below.

Lower-confidence links (1)

These come from early or generic mappings, text matching, or contradict this CVE’s details (for example a public-facing technique on a bug that needs a user to open a file). Shown for completeness.

  • Exploit Public-Facing ApplicationT1190 CTID attack_to_cve Phase 1 "Uncategorized" mapping (not staged by impact)

What security researchers reported

Not named in any threat report yet

Also mentioned in 12 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

References

3 links, grouped by NVD tag

vdb-entry 2

securitytracker.com/id/1041301securityfocus.com/bid/104763

x_refsource_CONFIRM 1

oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
↑ ↓ chooseEnter openEsc close