BLACKOUT MAP

Oracle · WebLogic Server

CVE-2017-3506

Oracle WebLogic Server OS Command Injection Vulnerability

Exploited in attacks High 7.4 Attack chance: 96%
Share

What it is

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.0, 12.2.1.1 and 12.2.1.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebLogic Server accessible data as well as unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.0 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).

CISA: Oracle WebLogic Server, a product within the Fusion Middleware suite, contains an OS command injection vulnerability that allows an attacker to execute arbitrary code via a specially crafted HTTP request that includes a malicious XML document.

What to do

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Deadline for US federal agencies: June 24, 2024

Added to the CISA list
June 3, 2024
Published
April 24, 2017
Severity
High 7.4 CVSS 3.1
Chance of attacks in the next 30 days (EPSS)
96% in the top 0.1% of all known vulnerabilities
Weakness
CWE-78
More details
NVD · CVE.org · CISA
All references (3)

More exploited flaws from Oracle

AddedVulnerabilityProductSeverityAttack chance
Jun 1, 2026UnspecifiedCVE-2024-21182WebLogic ServerHigh 7.574%
Jan 7, 2025UnspecifiedCVE-2020-2883WebLogic ServerCritical 9.895%
Sep 18, 2024Remote Code ExecutionCVE-2020-14644WebLogic ServerCritical 9.895%
May 1, 2023UnspecifiedCVE-2023-21839WebLogic ServerHigh 7.599.9%
Sep 8, 2022UnspecifiedCVE-2018-2628WebLogic ServerCritical 9.8>99.9%
Feb 10, 2022Corporation WebLogic Server Remote Code ExecutionCVE-2017-10271used by ransomwareWebLogic ServerHigh 7.5>99.9%
Jan 10, 2022WebLogic Server, InjectionCVE-2019-2725used by ransomwareWebLogic ServerHigh 7.5>99.9%
Nov 3, 2021Deserialization of Untrusted DataCVE-2015-4852WebLogic ServerCritical 9.895%

All of them →

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.