CVE-2018-2894: Critical severity oracle weblogic server vulnerability

Published Jul 18, 2018

Updated

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS - Web Services). Supported versions that are affected are 12.1.3.0, 12.2.1.2 and 12.2.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Affected Software

4 affected components

ORACLE WebLogic Server=10.3.6.0.0

ORACLE WebLogic Server=12.1.3.0.0

ORACLE WebLogic Server=12.2.1.2.0

ORACLE WebLogic Server=12.2.1.3

Remediation

Patch Available

http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html

Event History

Jul 18, 2018

CVE Published

via MITRE·01:00 PM

Data Sourced

via MITRE·01:00 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2018-2894?

CVE-2018-2894 is classified as a critical vulnerability, allowing unauthenticated attackers to exploit it easily.

How do I fix CVE-2018-2894?

To fix CVE-2018-2894, users should apply the latest security patches released by Oracle for affected versions of WebLogic Server.

What versions of Oracle WebLogic Server are affected by CVE-2018-2894?

CVE-2018-2894 affects Oracle WebLogic Server versions 12.1.3.0, 12.2.1.2, and 12.2.1.3.

Can CVE-2018-2894 be exploited remotely?

Yes, CVE-2018-2894 can be exploited remotely by an unauthenticated attacker with network access via HTTP.

What components of Oracle Fusion Middleware are affected by CVE-2018-2894?

CVE-2018-2894 specifically affects the Web Services component of the Oracle WebLogic Server.