Patchfirst
Patchfirst
CVE-2018-2894 Public exploit EPSS 50.2%

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS - Web Services)

Oracle Corporation · WebLogic Server

Summary

The vulnerability lies in the WLS - Web Services subcomponent of the Oracle WebLogic Server component of Oracle Fusion Middleware, affecting WebLogic Server versions 12.1.3.0, 12.2.1.2 and 12.2.1.3. An unauthenticated attacker with network access via HTTP can easily exploit it to take over the Oracle WebLogic Server, with no user interaction or special configuration required.

Official description · CVE.org

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS - Web Services). Supported versions that are affected are 12.1.3.0, 12.2.1.2 and 12.2.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Breakdown
76.3 / 100
Exploited
Yes, in VulnCheck KEV
Reports
1
Tactics
0/15

First seen exploited 6 months after disclosure. Public exploit code (PoC-in-GitHub) appeared 1 day after disclosure.

  1. Disclosedday 0
  2. Public exploit codePoC-in-GitHub+1 day
  3. First seen exploitedVulnCheck KEV evidence+6 mo
  4. Named in a threat reportresearch.checkpoint.com+7 mo

techniques

No techniques linked

No high- or medium-confidence techniques. The 2 available links are lower confidence and listed below.

Lower-confidence links (2)

These come from early or generic mappings, text matching, or contradict this CVE’s details (for example a public-facing technique on a bug that needs a user to open a file). Shown for completeness.

  • Exploit Public-Facing ApplicationT1190 CTID attack_to_cve Phase 1 "Uncategorized" mapping (not staged by impact)
  • Web ShellT1505.003 CTID attack_to_cve Phase 1 "Uncategorized" mapping (not staged by impact)

Detection

1 rule for this CVE · 0 general rules for its techniques

Rules for this CVE

1 that reference CVE-2018-2894 directly.

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

What security researchers reported

Named in 1 threat report
1 reportCheck PointFeb 2019

Reports are matched by finding the exact id CVE-2018-2894 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.

Check Point4 Feb 2019

SpeakUp: A New Undetected Backdoor Linux Trojan

Bypass Vulnerabilities b) CVE-2010-1871: JBoss Seam Framework remote code execution c) JBoss AS 3/4/5/6: Remote Command Execution (exploit) d) CVE-2017-10271: Oracle WebLogic wls-wsat Component Deserialization RCE e) CVE-2018-2894: Vulnerability in the Oracle WebLogic Server component of Oracle Fusion…

2 passages name itOriginal (opens in a new tab) ↗

Also mentioned in 14 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

References

3 links, grouped by NVD tag

vdb-entry 2

securitytracker.com/id/1041301securityfocus.com/bid/104763

x_refsource_CONFIRM 1

oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
↑ ↓ chooseEnter openEsc close