The version of Oracle WebLogic Server installed on the remote host is affected by multiple vulnerabilities :

  - A remote code execution vulnerability exists in the     Apache Struts component due to improper handling of     multithreaded access to an ActionForm instance. An     unauthenticated, remote attacker can exploit this, via a     specially crafted multipart request, to execute     arbitrary code or cause a denial of service condition.
    (CVE-2016-1181)

  - An unspecified flaw exists in the Web Services     subcomponent that allows an unauthenticated, remote     attacker to modify or delete arbitrary data accessible     to the server. (CVE-2017-3506)

  - A remote code execution vulnerability exists in the Web     Container subcomponent due to improper handling of     reflected PartItem File requests. An unauthenticated,     remote attacker can exploit this, via a specially     crafted request, to execute arbitrary code.
    (CVE-2017-3531)

  - A remote code execution vulnerability exists in the     Apache Struts component in the Jakarta Multipart parser     due to improper handling of the Content-Type,     Content-Disposition, and Content-Length headers.
    An unauthenticated, remote attacker can exploit this,     via a specially crafted header value in the HTTP     request, to execute arbitrary code. (CVE-2017-5638)

Detections

Analytics

Oracle WebLogic Server Multiple Vulnerabilities (April 2017 CPU)

critical Nessus Plugin ID 99528

Version 1.18

Version 1.17

Version 1.16

Version 1.18 Dec 26, 2025, 12:07 AM CVSS metrics ("CVSSv3 score" set to 9.8) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H") Plugin Feed: 202512260007
Version 1.17 Jun 5, 2024, 4:40 PM CISA reference Plugin Feed: 202406051640
Version 1.16 Jun 4, 2024, 7:00 PM CISA reference Plugin Feed: 202406041900