Published: 27/01/2017 Updated: 02/04/2019

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9

VMScore: 756

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Core Components). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.0 and 12.2.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS v3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).

Vulnerable Product	Search on Vulmon	Subscribe to Product
oracle weblogic server 12.2.1.0.0
oracle weblogic server 12.1.3.0.0
oracle weblogic server 10.3.6.0.0
oracle weblogic server 12.2.1.1.0

#!/usr/bin/python # -*- coding: utf-8 -*- from argparse import RawTextHelpFormatter import socket, argparse, subprocess, ssl, ospath HELP_MESSAGE = ''' -------------------------------------------------------------------------------------- Developped by bobsecq: quentinhardy@protonmailcom (quentinhardy@btcom) This script is the first public ...

Oracle WebLogic version 12120 RMI registry UnicastRef object java deserialization remote code execution exploit ...

Some scripts and exploits

exploits/weblogic/exploit-CVE-2017-3248-bobsecqpy The script exploit-CVE-2017-3248-bobsecqpy exploits the CVE-2017-3248 (wwwtenablecom/security/research/tra-2017-07) It is the first script/POC for exploiting the "Oracle WebLogic RMI Registry UnicastRef Object Java Deserialization Remote Code Execution" vulnerability because Tenable (which has discovered t

Some codes for bypassing Oracle WebLogic CVE-2018-2628 patch

ysoserial-cve-2018-2628 0x1 准备工作准备好POC脚本及Payload Object生成、JRMPListener运行所需软件环境 Python 27x Oracle Java SE 17+ 准备好一套安装好Patch Set Update 180417补丁的WebLogic Server 1036环境（仅有AdminServer即可）如果有现成的、已经安装好这个PSU版本的WebLogic环境，则可跳过这一步。准备好POC�

CVE-2017-3248

DGA cyberwtf/2017/08/30/dga-classification-and-detection-for-automated-malware-analysis/ githubcom/philarkwright/DGA-Detection githubcom/exp0se/dga_detector githubcom/jayjacobs/dga-tutorial githubcom/pchaigno/dga-collection githubcom/endgameinc/dga_predict githubcom/exctzo/dga_prediction_model **docs

NVD-CWE-noinfo http://www.oracle.com/technetwork/security-advisory/cpujan2017-2881727.html http://www.securityfocus.com/bid/95465 http://www.securitytracker.com/id/1037632 https://www.tenable.com/security/research/tra-2017-07 https://www.exploit-db.com/exploits/44998/http://packetstormsecurity.com/files/152357/Oracle-Weblogic-Server-Deserialization-RMI-UnicastRef-Remote-Code-Execution.html https://nvd.nist.gov https://github.com/quentinhardy/scriptsAndExploits https://www.exploit-db.com/exploits/44998/

CVE-2017-3248

Vulnerability Summary

Vulnerability Trend

Exploits

Github Repositories

References

Vulmon Search

About

Products

Connect