CVE-2017-10152: Infoleak

Published Oct 19, 2017

Updated

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Container). Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).

Affected Software

2 affected components

ORACLE WebLogic Server=10.3.6.0.0

ORACLE WebLogic Server=12.1.3.0.0

Remediation

Patch Available

http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

Event History

Oct 19, 2017

CVE Published

via MITRE·05:00 PM

Data Sourced

via MITRE·05:00 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2017-10152?

CVE-2017-10152 is considered a high severity vulnerability due to its ease of exploitation by low privileged attackers.

How do I fix CVE-2017-10152?

To fix CVE-2017-10152, apply the latest security patch released by Oracle for affected WebLogic Server versions.

What versions of WebLogic Server are affected by CVE-2017-10152?

CVE-2017-10152 affects Oracle WebLogic Server versions 10.3.6.0.0 and 12.1.3.0.0.

What type of access is required to exploit CVE-2017-10152?

CVE-2017-10152 can be exploited by attackers with low privileges and network access via HTTP.

Can CVE-2017-10152 lead to full system compromise?

Yes, CVE-2017-10152 allows an attacker to potentially compromise the Oracle WebLogic Server.