CVE-2018-2625: Medium severity oracle weblogic server vulnerability

Published Jan 18, 2018

Updated

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle WebLogic Server accessible data. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

Affected Software

3 affected components

ORACLE WebLogic Server=12.1.3.0.0

ORACLE WebLogic Server=12.2.1.2.0

ORACLE WebLogic Server=12.2.1.3.0

Remediation

Patch Available

http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html

Event History

Jan 18, 2018

CVE Published

via MITRE·02:00 AM

Data Sourced

via MITRE·02:00 AM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2018-2625?

CVE-2018-2625 is considered a critical vulnerability that allows unauthenticated attackers to execute arbitrary code remotely.

Which versions of Oracle WebLogic Server are affected by CVE-2018-2625?

CVE-2018-2625 affects Oracle WebLogic Server versions 12.1.3.0.0, 12.2.1.2.0, and 12.2.1.3.0.

How do I fix CVE-2018-2625?

To fix CVE-2018-2625, install the latest recommended patches provided by Oracle for your specific WebLogic Server version.

Can CVE-2018-2625 be exploited remotely?

Yes, CVE-2018-2625 can be easily exploited by an unauthenticated attacker with network access via HTTP.

What type of vulnerability is CVE-2018-2625?

CVE-2018-2625 is a remote code execution vulnerability in the Web Services component of Oracle WebLogic Server.