$ cve CVE-2017-3248 JSON

CVE-2017-3248 EXPLOIT

9.8

CRITICAL · CVSS 3.0 · EPSS 97.3% (pctl 100)

Patch early

A public exploit exists.

Description

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Core Components). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.0 and 12.2.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS v3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).

Scoring

CVSS	9.8 (CRITICAL, v3.0)
Vector	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS	97.3% — more likely to be exploited than 100% of all CVEs
On CISA KEV	no
Public exploit	yes
Published	2017-01-27
Last modified	2026-06-17

Affected (1)

Vendor	Product
oracle	weblogic server

Public exploits

Source	Title	Date
exploit-db	Oracle WebLogic 12.1.2.0 - RMI Registry UnicastRef Object Java Deserialization Remote Code Execution	2018-07-07

References

→ the Explorer · watch your stack · NVD