CVE-2018-2893: Critical severity oracle weblogic server vulnerability

Published Jul 18, 2018

Updated

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.2 and 12.2.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Affected Software

4 affected components

ORACLE WebLogic Server=10.3.6.0.0

ORACLE WebLogic Server=12.1.3.0.0

ORACLE WebLogic Server=12.2.1.2.0

ORACLE WebLogic Server=12.2.1.3

Remediation

Patch Available

http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html

Event History

Jul 18, 2018

CVE Published

via MITRE·01:00 PM

Data Sourced

via MITRE·01:00 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2018-2893?

CVE-2018-2893 is considered a high severity vulnerability due to its potential for unauthorized remote access.

How do I fix CVE-2018-2893?

To fix CVE-2018-2893, you should apply the latest patch or update provided by Oracle for affected WebLogic Server versions.

Which versions of WebLogic Server are affected by CVE-2018-2893?

CVE-2018-2893 affects WebLogic Server versions 10.3.6.0, 12.1.3.0, 12.2.1.2, and 12.2.1.3.

Can CVE-2018-2893 be exploited remotely?

Yes, CVE-2018-2893 can be easily exploited by an unauthenticated attacker with network access via T3.

What components of Oracle Fusion Middleware are impacted by CVE-2018-2893?

CVE-2018-2893 impacts the WLS Core Components of the Oracle WebLogic Server.