CVE-2017-10352
First published: Thu Oct 19 2017(Updated: )
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS - Web Services). The supported version that is affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0, 12.2.1.2.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. While the vulnerability is in Oracle WebLogic Server, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle WebLogic Server as well as unauthorized update, insert or delete access to some of Oracle WebLogic Server accessible data and unauthorized read access to a subset of Oracle WebLogic Server accessible data. CVSS 3.0 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H).
Credit: secalert_us@oracle.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Oracle WebLogic Server | =10.3.6.0.0 | |
| Oracle WebLogic Server | =12.1.3.0.0 | |
| Oracle WebLogic Server | =12.2.1.1.0 | |
| Oracle WebLogic Server | =12.2.1.2.0 | |
| Oracle WebLogic Server | =12.2.1.3.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2017-10352?
CVE-2017-10352 is considered a critical vulnerability due to its potential for exploitation by unauthenticated attackers.
How do I fix CVE-2017-10352?
To fix CVE-2017-10352, upgrade to the latest patched version of Oracle WebLogic Server as recommended by Oracle.
What components are affected by CVE-2017-10352?
CVE-2017-10352 affects the Oracle WebLogic Server component within Oracle Fusion Middleware.
What versions of WebLogic are impacted by CVE-2017-10352?
The affected versions by CVE-2017-10352 are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0, 12.2.1.2.0, and 12.2.1.3.0.
Can I exploit CVE-2017-10352 without authentication?
Yes, CVE-2017-10352 can be easily exploited by unauthenticated attackers over the network.
- agent/references
- agent/type
- agent/remedy
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/last-modified-date
- agent/severity
- agent/description
- agent/first-publish-date
- agent/event
- agent/softwarecombine
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/oracle
- canonical/oracle weblogic server
- version/oracle weblogic server/10.3.6.0.0
- version/oracle weblogic server/12.1.3.0.0
- version/oracle weblogic server/12.2.1.1.0
- version/oracle weblogic server/12.2.1.2.0
- version/oracle weblogic server/12.2.1.3.0