Vulnerability Details : CVE-2018-2628

Public exploit exists!
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.2 and 12.2.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Published 2018-04-19 02:29:00
Updated 2024-10-04 13:35:27
Source Oracle
View at NVD,   CVE.org

Products affected by CVE-2018-2628

CVE-2018-2628 is in the CISA Known Exploited Vulnerabilities Catalog

CISA vulnerability name:
Oracle WebLogic Server Unspecified Vulnerability
CISA required action:
Apply updates per vendor instructions.
CISA description:
Oracle WebLogic Server contains an unspecified vulnerability which can allow an unauthenticated attacker with T3 network access to compromise the server.
Notes:
https://www.oracle.com/security-alerts/cpuapr2018.html; https://nvd.nist.gov/vuln/detail/CVE-2018-2628
Added on 2022-09-08 Action due date 2022-09-29

Exploit prediction scoring system (EPSS) score for CVE-2018-2628

EPSS FAQ
97.51%
Probability of exploitation activity in the next 30 days EPSS Score History
~ 100 %
Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2018-2628

  • Oracle Weblogic Server Deserialization RCE
    Disclosure Date: 2018-04-17
    First seen: 2020-04-26
    exploit/multi/misc/weblogic_deserialize
    An unauthenticated attacker with network access to the Oracle Weblogic Server T3 interface can send a serialized object to the interface to execute code on vulnerable hosts. Authors: - brianwrf - Jacob Robles

CVSS scores for CVE-2018-2628

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source First Seen
7.5
 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P
10.0
6.4
 NIST
9.8
 CRITICAL CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
3.9
5.9
 NIST
9.8
 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
3.9
5.9
 134c704f-9b21-4f2e-91b3-4a467353bcc0 2024-10-03
9.8
 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
3.9
5.9
 NIST 2024-10-04

CWE ids for CVE-2018-2628

  • The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
    Assigned by:
    • 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)
    • nvd@nist.gov (Primary)

References for CVE-2018-2628

Jump to
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!
Accept Close