Oracle · WebLogic Server
CVE-2015-4852
Oracle WebLogic Server Deserialization of Untrusted Data Vulnerability
ما هي
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to execute arbitrary commands via a crafted serialized Java object in T3 protocol traffic to TCP port 7001, related to oracle_common/modules/com.bea.core.apache.commons.collections.jar. NOTE: the scope of this CVE is limited to the WebLogic Server product.
CISA: Oracle WebLogic Server contains a deserialization of untrusted data vulnerability within Apache Commons, which can allow for for remote code execution.
ما العمل
Apply updates per vendor instructions.
الموعد النهائي للوكالات الفدرالية الأمريكية: 3 مايو 2022
- أُضيفت إلى قائمة CISA
- 3 نوفمبر 2021
- نُشرت
- 18 نوفمبر 2015
- الخطورة
- حرجة 9.8 CVSS 3.1
- احتمال الهجمات خلال الأيام الـ30 القادمة (EPSS)
- 95% ضمن أعلى 0.1% من كل الثغرات المعروفة
- نوع الضعف
- CWE-502
- تفاصيل أكثر
- NVD · CVE.org · CISA
كل المراجع (15)
- http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
- http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html
- http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
- https://github.com/foxglovesec/JavaUnserializeExploits/blob/master/weblogic.py
- http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
- https://blogs.oracle.com/security/entry/security_alert_cve_2015_4852
- http://www.securitytracker.com/id/1038292
- http://www.securityfocus.com/bid/77539
- http://www.oracle.com/technetwork/topics/security/alert-cve-2015-4852-2763333.html
- http://www.openwall.com/lists/oss-security/2015/11/17/19
- https://www.exploit-db.com/exploits/42806/
- http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-…
- http://packetstormsecurity.com/files/152268/Oracle-Weblogic-Server-Deserialization-Remote-Code-Execution.html
- https://www.exploit-db.com/exploits/46628/
ثغرات مُستغلّة أخرى من Oracle
| أُضيفت | الثغرة | المنتج | الخطورة | احتمال الهجوم |
|---|---|---|---|---|
| 01/06/2026 | Unspecified | WebLogic Server | مرتفع 7.5 | 74% |
| 07/01/2025 | Unspecified | WebLogic Server | حرجة 9.8 | 95% |
| 18/09/2024 | Remote Code Execution | WebLogic Server | حرجة 9.8 | 95% |
| 03/06/2024 | OS Command Injection | WebLogic Server | مرتفع 7.4 | 96% |
| 01/05/2023 | Unspecified | WebLogic Server | مرتفع 7.5 | 99.9% |
| 08/09/2022 | Unspecified | WebLogic Server | حرجة 9.8 | >99.9% |
| 10/02/2022 | Corporation WebLogic Server Remote Code Execution | WebLogic Server | مرتفع 7.5 | >99.9% |
| 10/01/2022 | WebLogic Server, Injection | WebLogic Server | مرتفع 7.5 | >99.9% |
المصادر: Known Exploited Vulnerabilities (CISA، ملكية عامة)، وCVE records (cve.org)، وEPSS (FIRST). احتمال الهجوم هو تقدير EPSS لاحتمال أن يحاول أحد استغلال الثغرة خلال الأيام الـ30 القادمة.