NetSight
IP …
critical9.8Known exploitedPublic exploit code

CVE-2015-4852

Oracle WebLogic Server Deserialization of Untrusted Data Vulnerability

Exploited in the wild

This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2021-11-03. Federal due date: 2022-05-03.

Apply updates per vendor instructions.

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to execute arbitrary commands via a crafted serialized Java object in T3 protocol traffic to TCP port 7001, related to oracle_common/modules/com.bea.core.apache.commons.collections.jar. NOTE: the scope of this CVE is limited to the WebLogic Server product.

Affected products

VendorProductAffected versions
OracleVirtual Desktop Infrastructure
through 3.5.2
OracleStoragetek Tape Analytics Sw Tool
Version 2.3
OracleWeblogic Server
Versions 10.3.6.0.0, 12.1.2.0.0, 12.1.3.0.0, 12.2.1.0.0

Weakness classification

CWE-502

References