Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components)
Oracle Corporation · WebLogic Server
The flaw lies in the WLS Core Components subcomponent of the Oracle WebLogic Server component within Oracle Fusion Middleware, affecting supported versions 10.3.6.0, 12.1.3.0 and 12.2.1.3. An unauthenticated attacker with network access via the T3 protocol can easily exploit it to take over the Oracle WebLogic Server, with no user interaction or special configuration required.
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). Supported versions that are affected are 10.3.6.0, 12.1.3.0 and 12.2.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
- Exploited
- Not confirmed
- Reports
- 0
- Tactics
- 0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
Public exploit code (PoC-in-GitHub) appeared 5 days after disclosure. No confirmed exploitation is recorded.
- Disclosedday 0
- Public exploit codePoC-in-GitHub+5 days
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linkedNo ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.