CVE-2017-10271: high-severity vulnerability in Oracle Corporation WebLogic Server
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
100Vexday Risk Score
Patch now. It under exploitation confirmed by CISA, has a working public exploit and 1 threat group(s) use it.
ssvc Actcvss 7.5epss 100%
from disclosure to weapon65 days
Published on NVDOct 19
1st PoC+65d
metasploitOct 19
CISA KEV+1575d
Who exploits it — 1
Groups known to exploit this vulnerability (MITRE ATT&CK attribution).
APT / StateRocke🇨🇳 MITRE ATT&CK
Action required by CISAfederal deadline: 2022-08-10
Apply updates per vendor instructions.
In short
Oracle WebLogic Server has a security flaw that allows attackers to crash or disable the server without needing a password. An attacker only needs network access to exploit it, making this a serious threat.
Technical detail
Unauthenticated remote code execution vulnerability in Oracle WebLogic Server (versions 10.3.6, 12.1.3, 12.2.1.1, 12.2.1.2) accessible via T3 protocol without authentication or user interaction. Successful exploitation results in denial of service with high availability impact; the vulnerability exists in the WLS Security subcomponent due to missing authentication controls (CWE-306).
Summary generated and translated by AI from the official description.
The full analysis of this CVE is available in Portuguese →
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Security). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0 and 12.2.1.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Oracle Corporation · WebLogic Serverpublic PoCs found — 62✓ VexDay Proof
exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/43458exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/43924exploitdbwww.exploit-db.com/exploits/43392unverifiedgithubgithub.com/shack2/javaserializetools★ 516githubgithub.com/c0mmand3rOpSec/CVE-2017-10271★ 140githubgithub.com/kkirsche/CVE-2017-10271★ 128githubgithub.com/7kbstorm/WebLogic_CNVD_C2019_48814★ 115githubgithub.com/SkyBlueEternal/CNVD-C-2019-48814-CNNVD-201904-961★ 105githubgithub.com/1337g/CVE-2017-10271★ 38githubgithub.com/Cymmetria/weblogic_honeypot★ 33githubgithub.com/Luffin/CVE-2017-10271★ 29githubgithub.com/s3xy/CVE-2017-10271★ 22githubgithub.com/ETOCheney/JavaDeserialization★ 9githubgithub.com/SuperHacker-liuan/cve-2017-10271-poc★ 7githubgithub.com/pssss/CVE-2017-10271★ 5githubgithub.com/kbsec/Weblogic_Wsat_RCE★ 4githubgithub.com/pizza-power/weblogic-CVE-2019-2729-POC★ 3githubgithub.com/cjjduck/weblogic_wls_wsat_rce★ 3githubgithub.com/ZH3FENG/PoCs-Weblogic_2017_10271★ 3githubgithub.com/ianxtianxt/-CVE-2017-10271-★ 2githubgithub.com/Al1ex/CVE-2017-10271★ 2githubgithub.com/Yuusuke4/WebLogic_CNVD_C_2019_48814★ 1githubgithub.com/JackyTsuuuy/weblogic_wls_rce_poc-exp★ 1githubgithub.com/lonehand/Oracle-WebLogic-CVE-2017-10271-master★ 1githubgithub.com/XHSecurity/Oracle-WebLogic-CVE-2017-10271★ 1githubgithub.com/peterpeter228/Oracle-WebLogic-CVE-2017-10271★ 0githubgithub.com/testwc/CVE-2017-10271★ 0githubgithub.com/r4b3rt/CVE-2017-10271★ 0githubgithub.com/shahdawadfallah-sys/Cybersecurity-Capstone-Project★ 0githubgithub.com/Dungsocool/CVE-2017-10271★ 0githubgithub.com/seoyoung-kang/CVE-2017-10271★ 0githubgithub.com/cved-sources/cve-2017-10271★ 0githubgithub.com/KKsdall/7kbstormq★ 0githubgithub.com/CyberCTF/vulhub-weblogic-cve-2017-10271★ 0vulncheckvulncheck.com/xdb/81bc72dbea42unverifiedvulncheckvulncheck.com/xdb/f7947284ec6funverifiedcve_referencewww.exploit-db.com/exploits/43924/unverifiedvulncheckvulncheck.com/xdb/35513a38c8c0unverifiedcve_referencewww.exploit-db.com/exploits/43458/unverifiedvulncheckvulncheck.com/xdb/d4ef87756956unverifiedvulncheckvulncheck.com/xdb/07ffaabdd9b4unverifiedvulncheckvulncheck.com/xdb/227b6343c39aunverifiedvulncheckvulncheck.com/xdb/ceea1ee6f89dunverifiedvulncheckvulncheck.com/xdb/5876caaffa74unverifiedvulncheckvulncheck.com/xdb/d09b1e7f97ccunverifiedvulncheckvulncheck.com/xdb/5db29476379funverifiedvulncheckvulncheck.com/xdb/09caa396fa9dunverifiedvulncheckvulncheck.com/xdb/5d3fcd41baa9unverifiedvulncheckvulncheck.com/xdb/79b07cfac599unverifiedvulncheckvulncheck.com/xdb/f9f1cd530e9eunverifiedvulncheckvulncheck.com/xdb/14ab6f8b9982unverifiedvulncheckvulncheck.com/xdb/b1d32de02744unverifiedvulncheckvulncheck.com/xdb/439d9489666cunverifiedvulncheckvulncheck.com/xdb/3f317861c109unverifiedvulncheckvulncheck.com/xdb/45527e228cbcunverifiedvulncheckvulncheck.com/xdb/560237e691a7unverifiedvulncheckvulncheck.com/xdb/7e0283e80991unverifiedvulncheckvulncheck.com/xdb/e9e5a0e896a8unverifiedvulncheckvulncheck.com/xdb/748e47609e78unverifiedvulncheckvulncheck.com/xdb/84b051e655c3unverifiedvulncheckvulncheck.com/xdb/81cdfcff4f97unverifiedvulncheckvulncheck.com/xdb/ecdc2e1ce596unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Oracle Corporation WebLogic Server
In the same product, most dangerous first.
References
https://github.com/c0mmand3rOpSec/CVE-2017-10271https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-10271https://www.exploit-db.com/exploits/43458/https://www.exploit-db.com/exploits/43924/http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.htmlhttp://www.securityfocus.com/bid/101304http://www.securitytracker.com/id/1039608