Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS - Web Services). The supported version that is affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0, 12.2.1.2.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. While the vulnerability is in Oracle WebLogic Server, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle WebLogic Server as well as unauthorized update, insert or delete access to some of Oracle WebLogic Server accessible data and unauthorized read access to a subset of Oracle WebLogic Server accessible data. CVSS 3.0 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H).

The version of WebLogic Server installed on the remote host is affected by multiple vulnerabilities as referenced in the January 2018 CPU advisory, as follows:

  - Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS - Web     Services). The supported version that is affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0, 12.2.1.2.0 and     12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP     to compromise Oracle WebLogic Server. While the vulnerability is in Oracle WebLogic Server, attacks may     significantly impact additional products. Successful attacks of this vulnerability can result in     unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle WebLogic     Server as well as unauthorized update, insert or delete access to some of Oracle WebLogic Server     accessible data and unauthorized read access to a subset of Oracle WebLogic Server accessible data.
    (CVE-2017-10352)

  - Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web     Services). Supported versions that are affected are 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.2.0. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise     Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized read access to     a subset of Oracle WebLogic Server accessible data. (CVE-2018-2625)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle WebLogic server is affected by a remote code execution vulnerability in the WSAT endpoint due to unsafe deserialization of XML encoded Java objects. An unauthenticated, remote attacker can exploit this, via a crafted Java object, to execute arbitrary Java code in the context of the WebLogic server.

According to its self-reported version, the Oracle iPlanet Web Server (formerly known as Sun Java System Web Server) running on the remote host is 7.0.x prior to 7.0.27 Patch 26834070. It is, therefore, affected by an unspecified vulnerability in the Network Security Services (NSS) library with unknown impact.

The version of Oracle HTTP Server installed on the remote host is affected by multiple vulnerabilities as noted in the January 2018 CPU advisory.

The version of Oracle WebLogic Server installed on the remote host is affected by multiple vulnerabilities

ID	Name	Product	Family	Type	Severity
144326	Oracle WebLogic Server Multiple Vulnerabilities (Jan 2018 CPU)	Nessus	Misc.	Local	critical
112524	Oracle WebLogic WSAT Remote Code Execution	Web App Scanning	Component Vulnerability	Check Based	critical
106349	Oracle iPlanet Web Server 7.0.x < 7.0.27 NSS Unspecified Vulnerability (January 2018 CPU)	Nessus	Web Servers	Remote	critical
106299	Oracle Fusion Middleware Oracle HTTP Server Multiple Vulnerabilities (January 2018 CPU)	Nessus	Web Servers	Local	critical
103935	Oracle WebLogic Server Multiple Vulnerabilities (October 2017 CPU)	Nessus	Misc.	Local	critical

Detections

Analytics

CVE-2017-10352

critical

Tenable Plugins

critical

critical

critical

critical

critical