peter bassill · operator
$ cve CVE-2017-3506 JSON

CVE-2017-3506 KEV

7.4
HIGH · CVSS 3.1 · EPSS 96.3% (pctl 100)

Patch first

On CISA KEV — known exploited in the wild, due 2024-06-24.

Description

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.0, 12.2.1.1 and 12.2.1.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebLogic Server accessible data as well as unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.0 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).

Scoring

CVSS7.4 (HIGH, v3.1)
VectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS96.28% — more likely to be exploited than 100% of all CVEs
WeaknessCWE-78
On CISA KEVyes — remediate by 2024-06-24
Public exploitnone known
Published2017-04-24
Last modified2026-06-17

CISA KEV

NameOracle WebLogic Server OS Command Injection Vulnerability
Added2024-06-03
Due2024-06-24
Vendor / productOracle / WebLogic Server
Ransomware usenone reported

Affected (1)

VendorProduct
oracleweblogic server

References

→ the Explorer  ·  watch your stack  ·  NVD