CVE-2016-3505: Critical severity oracle weblogic server vulnerability

Published Oct 25, 2016

Updated

Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0, 12.1.3.0, and 12.2.1.0 allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to JavaServer Faces.

Affected Software

3 affected components

ORACLE WebLogic Server=10.3.6.0.0

ORACLE WebLogic Server=12.1.3.0.0

ORACLE WebLogic Server=12.2.1.0.0

Remediation

Patch Available

http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html

Event History

Oct 25, 2016

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2016-3505?

CVE-2016-3505 has a CVSS score that indicates it has a moderate severity level.

How do I fix CVE-2016-3505?

To fix CVE-2016-3505, upgrade to a patched version of Oracle WebLogic Server as recommended in Oracle's security advisory.

Who is affected by CVE-2016-3505?

CVE-2016-3505 affects remote authenticated users of Oracle WebLogic Server versions 10.3.6.0, 12.1.3.0, and 12.2.1.0.

What type of vulnerability is CVE-2016-3505?

CVE-2016-3505 is an unspecified vulnerability related to JavaServer Faces that can impact confidentiality, integrity, and availability.

What versions of Oracle WebLogic Server are vulnerable to CVE-2016-3505?

Versions 10.3.6.0, 12.1.3.0, and 12.2.1.0 of Oracle WebLogic Server are vulnerable to CVE-2016-3505.