Published: 17/10/2018 Updated: 03/10/2019

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9

VMScore: 668

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). Supported versions that are affected are 10.3.6.0, 12.1.3.0 and 12.2.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Vulnerable Product	Search on Vulmon	Subscribe to Product
oracle weblogic server 12.2.1.3.0
oracle weblogic server 12.1.3.0.0
oracle weblogic server 10.3.6.0.0

Weblogic-CVE-2018-3252

CVE-2018-3252 Weblogic-CVE-2018-3252

CVE-2018-3252-PoC

CVE-2018-3252-PoC 1Generate PoC with YSOSERIAL 2You should know the USERNAME and PASSWORD of the target weblogic server 3Send the payload to the URL POST /bea_wls_deployment_internal/DeploymentService HTTP/11 Host: 127001:7001 Accept: text/html,application/xhtml+xml,application/xml;q=09,image/webp,*/*;q=08 Upgrade-Insecure-Requests: 1 wl_request_type: data_transfer_req

CVE-2018-3252 1、反编译weblogic private void handleDataTransferRequest(HttpServletRequest paramHttpServletRequest, HttpServletResponse paramHttpServletResponse, AuthenticatedSubject paramAuthenticatedSubject) throws IOException { if (isDebugEnabled()) { debug("Received DataTransferRequest : "); } String str1 = readO

NVD-CWE-noinfo http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html http://www.securitytracker.com/id/1041896 http://www.securityfocus.com/bid/105613 https://security.gentoo.org/glsa/201908-24 https://nvd.nist.gov https://github.com/jas502n/CVE-2018-3252

CVE-2018-3252

Vulnerability Summary

Vulnerability Trend

Github Repositories

References

Vulmon Search

About

Products

Connect