{"id":"CVE-2018-2894","published":"2018-07-18T13:00:00Z","modified":"2024-10-02T20:21:29Z","title":"Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS - Web Services)","vendor":"Oracle Corporation","product":"WebLogic Server","tier":"core","eol":null,"affectedVersions":[{"vendor":"Oracle Corporation","product":"WebLogic Server","versions":["12.1.3.0","12.2.1.2","12.2.1.3"]}],"description":{"text":"Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS - Web Services). Supported versions that are affected are 12.1.3.0, 12.2.1.2 and 12.2.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","provenance":"source","from":"CVE.org"},"summary":{"text":"The vulnerability lies in the WLS - Web Services subcomponent of the Oracle WebLogic Server component of Oracle Fusion Middleware, affecting WebLogic Server versions 12.1.3.0, 12.2.1.2 and 12.2.1.3. An unauthenticated attacker with network access via HTTP can easily exploit it to take over the Oracle WebLogic Server, with no user interaction or special configuration required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:16:29Z"},"cvss":null,"epss":{"score":0.50224,"percentile":0.98905,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2019-01-08","exploitedFirstSeen":"2019-01-08","ransomware":true,"evidence":[{"url":"https://www.lacework.com/blog/elf-of-the-month-new-lucky-ransomware-sample/","date":"2019-01-08"},{"url":"https://www.fortinet.com/blog/threat-research/closer-look-satan-ransomwares-propagation-technics","date":"2019-05-20"},{"url":"https://web.archive.org/web/20220227045141/https://risksense.com/wp-content/uploads/2019/09/RiskSense-Spotlight-Report-Ransomware.pdf","date":"2019-09-01"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-02&host_type=src&vulnerability=cve-2018-2894","date":"2023-12-02"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-05&host_type=src&vulnerability=cve-2018-2894","date":"2023-12-05"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-11&host_type=src&vulnerability=cve-2018-2894","date":"2023-12-11"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-14&host_type=src&vulnerability=cve-2018-2894","date":"2023-12-14"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-25&host_type=src&vulnerability=cve-2018-2894","date":"2023-12-25"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-01&host_type=src&vulnerability=cve-2018-2894","date":"2024-01-01"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-04&host_type=src&vulnerability=cve-2018-2894","date":"2024-01-04"}],"evidenceTotal":751,"provenance":"source"},"exploited":true,"otx":{"pulseCount":14,"pulses":[{"name":"ripe.arin.enom.cpanel.cpcalendar.iana.networksolutions.02050.webdisk.webmail.","url":"https://otx.alienvault.com/pulse/69fdc02bea1e4ec923b01688","created":"2026-05-08"},{"name":"Spam “Broken Seal” DocuSign-themed Delivery w/Fileless Process Hollowing (Zeppelin/Bloat-A) by msudosos","url":"https://otx.alienvault.com/pulse/69bf64eccb5d39a90a3c391e","created":"2026-03-22"},{"name":"Spam “Broken Seal” DocuSign-themed Delivery w/Fileless Process Hollowing (Zeppelin/Bloat-A) by msudosos","url":"https://otx.alienvault.com/pulse/69bf64e1d5e06aa6207f78de","created":"2026-03-22"},{"name":"VirusTotal report\n                    for Bang Bang#2.xls","url":"https://otx.alienvault.com/pulse/69b4e2ca96bf79781b0ae3bd","created":"2026-03-14"},{"name":"Distributed Credential Exhaustion & C2 Orchestration via Golang-Based StealthWorker (ELF.Agent-VW)","url":"https://otx.alienvault.com/pulse/6992bae83a5988dff8311490","created":"2026-02-16"},{"name":"CVE Data","url":"https://otx.alienvault.com/pulse/69929b597293fe5837b9c95c","created":"2026-02-16"},{"name":"“Broken Seal” DocuSign-themed Delivery with Fileless Process Hollowing (Zeppelin/Bloat-A)","url":"https://otx.alienvault.com/pulse/698e93e1ab02db8c49e8c3ed","created":"2026-02-13"},{"name":"151.101.0.22","url":"https://otx.alienvault.com/pulse/698918baac756a084ef67089","created":"2026-02-08"},{"name":"hostasa.org","url":"https://otx.alienvault.com/pulse/698910e3f78fe72e45c8e068","created":"2026-02-08"},{"name":"hostasa.org","url":"https://otx.alienvault.com/pulse/698910df5a3e7798d4da271a","created":"2026-02-08"}],"provenance":"machine"},"cwes":[],"references":[{"url":"http://www.securitytracker.com/id/1041301","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","tags":["x_refsource_CONFIRM"]},{"url":"http://www.securityfocus.com/bid/104763","tags":["vdb-entry","x_refsource_BID"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 1)","mappingType":"uncategorized","evidence":[],"confidence":"low","confidenceNote":"CTID attack_to_cve Phase 1 \"Uncategorized\" mapping (not staged by impact)"},{"id":"T1505.003","name":"Web Shell","tactics":["persistence"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 1)","mappingType":"uncategorized","evidence":[],"confidence":"low","confidenceNote":"CTID attack_to_cve Phase 1 \"Uncategorized\" mapping (not staged by impact)"}],"reports":[{"id":"SRC-47d1c126a36d01f3bea4","title":"SpeakUp: A New Undetected Backdoor Linux Trojan","publisher":"research.checkpoint.com","url":"https://research.checkpoint.com/2019/speakup-a-new-undetected-backdoor-linux-trojan/","date":"2019-02-04","mentions":[{"quote":"Bypass Vulnerabilities\nb) CVE-2010-1871: JBoss Seam Framework remote code execution\nc) JBoss AS 3/4/5/6: Remote Command Execution (exploit)\nd) CVE-2017-10271: Oracle WebLogic wls-wsat Component Deserialization RCE\ne) CVE-2018-2894: Vulnerability in the Oracle WebLogic Server component of Oracle Fusion","start":6401,"end":6703},{"quote":"- Oracle WebLogic WLS Server Component Arbitrary File Upload(CVE-2018-2894)","start":10048,"end":10123}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2018-14749","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-14749","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":4,"skipped":0,"earliest":"2018-07-19","earliestUrl":"https://github.com/111ddea/cve-2018-2894","repos":[{"name":"LandGrey/CVE-2018-2894","url":"https://github.com/LandGrey/CVE-2018-2894","stars":139,"created":"2018-07-20"},{"name":"k8gege/PyLadon","url":"https://github.com/k8gege/PyLadon","stars":53,"created":"2019-11-19"},{"name":"jas502n/CVE-2018-2894","url":"https://github.com/jas502n/CVE-2018-2894","stars":19,"created":"2018-10-07"},{"name":"111ddea/cve-2018-2894","url":"https://github.com/111ddea/cve-2018-2894","stars":15,"created":"2018-07-19"}]},"nuclei":[{"id":"CVE-2018-2894","name":"Oracle WebLogic Server - Remote Code Execution","severity":"critical","path":"http/cves/2018/CVE-2018-2894.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-2894.yaml"}],"first":{"date":"2018-07-19","source":"PoC-in-GitHub","url":"https://github.com/111ddea/cve-2018-2894"},"provenance":"source"},"detections":{"cveRules":[{"title":"Oracle WebLogic Exploit","id":"37e8369b-43bb-4bf8-83b6-6dd43bda2000","level":"critical","status":"test","path":"rules-emerging-threats/2018/Exploits/CVE-2018-2894/web_cve_2018_2894_weblogic_exploit.yml","url":"https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2018/Exploits/CVE-2018-2894/web_cve_2018_2894_weblogic_exploit.yml","techniques":["T1190","T1505.003"]}]},"exploitRefs":[],"flow":[{"stage":"related","techniques":["T1190","T1505.003"],"provenance":"source","lowConfidence":true}],"timeline":[{"date":"2018-07-18","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2018-2894","provenance":"source"},{"date":"2018-07-19","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/111ddea/cve-2018-2894","provenance":"source"},{"date":"2019-01-08","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.lacework.com/blog/elf-of-the-month-new-lucky-ransomware-sample/","provenance":"source"},{"date":"2019-02-04","kind":"report","label":"Named in research.checkpoint.com: SpeakUp: A New Undetected Backdoor Linux Trojan","url":"https://research.checkpoint.com/2019/speakup-a-new-undetected-backdoor-linux-trojan/","provenance":"machine"}],"speed":{"daysToPublicExploit":1,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":76.3,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 2853 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.78,"detail":"percentile 0.9890"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"4 PoC-in-GitHub repos; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":2.67,"detail":"14 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}