CVE-2018-2628

Oracle WebLogic Server: Unspecified

As of , CVE-2018-2628 in Oracle WebLogic Server is on CISA's list of exploited vulnerabilities: CISA listed it on . Our patch-first group: Patch this week.

Exploited
Yes: CISA listed it on 8 September 2022
US federal deadline
29 September 202221 days after CISA listed it. US federal civilian agencies must fix it by then.
Used in ransomware campaigns
Not known to CISA
EPSS score
0.99Higher than 99% of the CVEs EPSS scores. EPSS estimates the chance of exploitation activity in the next 30 days.
EPSS when listed
0.95 on 8 September 2022EPSS on the day CISA listed it.
Public exploit
1 Metasploit module and 3 Exploit-DB entries (2 verified)
Fix
Vendor advice: www.oracle.comLinks below, from CISA's entry.

What CISA says to do

Apply updates per vendor instructions.

CISA's required action

What the flaw is

Oracle WebLogic Server contains an unspecified vulnerability which can allow an unauthenticated attacker with T3 network access to compromise the server.

CISA's description

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.2 and 12.2.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

The CVE record's description, from oracle

CVE published
19 April 2018
Assigned by
oracle
CVSS
9.8 Critical (CVSS 3.1, from CISA-ADP)
CWE-502
Deserialization of Untrusted Data
CISA SSVC, exploitation
active
CISA SSVC, automatable
yes
CISA SSVC, technical impact
total

Timeline

  1. The CVE record was published.
  2. Exploit-DB published an exploit (EDB-ID 44553).
  3. Exploit-DB published an exploit (EDB-ID 45193).
  4. Exploit-DB published an exploit (EDB-ID 46513).
  5. CISA added it to its list of exploited vulnerabilities.
  6. The US federal deadline to fix it.

Public exploits

Facts from Metasploit's module list and Exploit-DB's index; we never copy exploit code.

WebLogic Server: other exploited entries

VulnerabilityProductOur groupListedDeadlineEPSS
CVE-2017-10271Corporation WebLogic Server Remote Code ExecutionOracle WebLogic ServerPatch this weekRansomware use; Metasploit module; EPSS 0.99; verified Exploit-DB entry0.99
CVE-2019-2725WebLogic Server, InjectionOracle WebLogic ServerPatch this weekRansomware use; Metasploit module; EPSS 0.99; verified Exploit-DB entry0.99
CVE-2015-4852Deserialization of Untrusted DataOracle WebLogic ServerPatch this weekMetasploit module; EPSS 0.96; verified Exploit-DB entry0.96
CVE-2020-2883UnspecifiedOracle WebLogic ServerPatch this weekMetasploit module; EPSS 0.950.95
CVE-2023-21839UnspecifiedOracle WebLogic ServerPatch this weekMetasploit module; EPSS 0.990.99
CVE-2020-14750Remote Code ExecutionOracle WebLogic ServerPatch this weekMetasploit module; EPSS 0.990.99
CVE-2020-14882Remote Code ExecutionOracle WebLogic ServerPatch this weekMetasploit module; EPSS 0.990.99
CVE-2020-14883UnspecifiedOracle WebLogic ServerPatch this weekMetasploit module; EPSS 0.980.98
CVE-2024-21182UnspecifiedOracle WebLogic ServerPatch this weekEPSS 0.740.74
CVE-2020-14644Remote Code ExecutionOracle WebLogic ServerPatch this weekEPSS 0.950.95

All 12 entries for WebLogic Server

Read further