CVE-2017-10137: Critical severity oracle weblogic server vulnerability

Published Aug 8, 2017

Updated

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: JNDI). Supported versions that are affected are 10.3.6.0 and 12.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. While the vulnerability is in Oracle WebLogic Server, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).

Affected Software

2 affected components

ORACLE WebLogic Server=10.3.6.0.0

ORACLE WebLogic Server=12.1.3.0.0

Remediation

Patch Available

http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html

Event History

Aug 8, 2017

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2017-10137?

CVE-2017-10137 has a CVSS score indicating it is a high severity vulnerability.

How do I fix CVE-2017-10137?

To fix CVE-2017-10137, update Oracle WebLogic Server to the latest patched version.

Who is affected by CVE-2017-10137?

CVE-2017-10137 affects users of Oracle WebLogic Server versions 10.3.6.0 and 12.1.3.0.

What type of attack can exploit CVE-2017-10137?

CVE-2017-10137 can be exploited by unauthenticated attackers remotely via HTTP.

What components of Oracle Fusion Middleware are affected by CVE-2017-10137?

CVE-2017-10137 specifically affects the JNDI component of Oracle WebLogic Server.