CVE-2017-10123: Medium severity oracle weblogic server vulnerability

Published Aug 8, 2017

Updated

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Container). The supported version that is affected is 12.1.3.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle WebLogic Server accessible data. CVSS 3.0 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).

Affected Software

1 affected component

ORACLE WebLogic Server=12.1.3.0.0

Remediation

Patch Available

http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html

Event History

Aug 8, 2017

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2017-10123?

CVE-2017-10123 is rated as a critical severity vulnerability that allows remote code execution.

How do I fix CVE-2017-10123?

To fix CVE-2017-10123, update Oracle WebLogic Server to the latest version provided by Oracle.

Who is affected by CVE-2017-10123?

CVE-2017-10123 affects Oracle WebLogic Server version 12.1.3.0.0.

What can an attacker do with CVE-2017-10123?

An attacker exploiting CVE-2017-10123 can execute arbitrary code on the Oracle WebLogic Server.

Is CVE-2017-10123 easy to exploit?

Yes, CVE-2017-10123 is considered easily exploitable with low privileges over HTTP.