Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.2 and 12.2.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

The remote host is running a version of Oracle WebLogic Server that is affected by multiple RCE vulnerabilities:

 - A vulnerability exists that allows an unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. (CVE-2018-2628)
 - A deserialization vulnerability via XMLDecoder exists in Oracle WebLogic Server Web Services. This remote code execution vulnerability is remotely exploitable without authentication, i.e., may be exploited over a network without the need for a username and password. (CVE-2019-2729)

The remote Oracle WebLogic server is affected by a remote code execution vulnerability in the Core Components subcomponent due to unsafe deserialization of Java objects by the RMI registry. An unauthenticated, remote attacker can exploit this, via a crafted Java object, to execute arbitrary Java code in the context of the WebLogic server.

Note that this plugin does not attempt to exploit this RCE directly and instead checks for the presence of the patch Oracle supplied in the April 2018 critical patch update (CPU).

The version of Oracle WebLogic Server installed on the remote host is affected by multiple vulnerabilities

ID	Name	Product	Family	Severity
700244	Oracle WebLogic Multiple Java Object Deserialization RCE	Nessus Network Monitor	Web Servers	critical
109429	Oracle WebLogic Server Deserialization RCE (CVE-2018-2628)	Nessus	Web Servers	critical
109201	Oracle WebLogic Server Multiple Vulnerabilities (April 2018 CPU)	Nessus	Misc.	critical

Detections

Analytics

CVE-2018-2628

critical

Tenable Plugins

critical

critical

critical