Oracle · WebLogic Server
CVE-2015-4852
Oracle WebLogic Server Deserialization of Untrusted Data Vulnerability
概要
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to execute arbitrary commands via a crafted serialized Java object in T3 protocol traffic to TCP port 7001, related to oracle_common/modules/com.bea.core.apache.commons.collections.jar. NOTE: the scope of this CVE is limited to the WebLogic Server product.
CISA: Oracle WebLogic Server contains a deserialization of untrusted data vulnerability within Apache Commons, which can allow for for remote code execution.
対処法
Apply updates per vendor instructions.
米国連邦機関の対応期限：2022年5月3日
- CISAのリストに追加
- 2021年11月3日
- 公開日
- 2015年11月18日
- 深刻度
- 緊急 9.8 CVSS 3.1
- 今後30日間に攻撃される可能性（EPSS）
- 95% 既知の全脆弱性の上位0.1%
- 脆弱性の種類
- CWE-502
- 詳細
- NVD · CVE.org · CISA
すべての参照（15件）
- http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
- http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html
- http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
- https://github.com/foxglovesec/JavaUnserializeExploits/blob/master/weblogic.py
- http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
- https://blogs.oracle.com/security/entry/security_alert_cve_2015_4852
- http://www.securitytracker.com/id/1038292
- http://www.securityfocus.com/bid/77539
- http://www.oracle.com/technetwork/topics/security/alert-cve-2015-4852-2763333.html
- http://www.openwall.com/lists/oss-security/2015/11/17/19
- https://www.exploit-db.com/exploits/42806/
- http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-…
- http://packetstormsecurity.com/files/152268/Oracle-Weblogic-Server-Deserialization-Remote-Code-Execution.html
- https://www.exploit-db.com/exploits/46628/
Oracleのその他の悪用された脆弱性
| 追加日 | 脆弱性 | 製品 | 深刻度 | 攻撃の可能性 |
|---|---|---|---|---|
| 2026/06/01 | Unspecified | WebLogic Server | 高 7.5 | 74% |
| 2025/01/07 | Unspecified | WebLogic Server | 緊急 9.8 | 95% |
| 2024/09/18 | Remote Code Execution | WebLogic Server | 緊急 9.8 | 95% |
| 2024/06/03 | OS Command Injection | WebLogic Server | 高 7.4 | 96% |
| 2023/05/01 | Unspecified | WebLogic Server | 高 7.5 | 99.9% |
| 2022/09/08 | Unspecified | WebLogic Server | 緊急 9.8 | >99.9% |
| 2022/02/10 | Corporation WebLogic Server Remote Code Execution | WebLogic Server | 高 7.5 | >99.9% |
| 2022/01/10 | WebLogic Server, Injection | WebLogic Server | 高 7.5 | >99.9% |
出典：Known Exploited Vulnerabilities（CISA、パブリックドメイン）、CVE records（cve.org）、EPSS（FIRST）。攻撃の可能性は、今後30日以内に誰かがその脆弱性の悪用を試みるというEPSSの推定値です。