Quantum Secular Labs / Blog / Advisories

CVE-2017-10352: Oracle Weblogic Server: Authentication bypass

CVE-2017-10352 is rated critical with a CVSS v3.0 base score of 9.9 and affects Oracle Weblogic Server. Per its scoring, it can be exploited over the network, without authentication, without any user interaction.

Vulnerability description

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS - Web Services). The supported version that is affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0, 12.2.1.2.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. While the vulnerability is in Oracle WebLogic Server, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle WebLogic Server as well as unauthorized update, insert or delete access to some of Oracle WebLogic Server accessible data and unauthorized read access to a subset of Oracle WebLogic Server accessible data. CVSS 3.0 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H).

Severity breakdown

CVSS v3.0 9.9: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H

  • Attack vector: Network. Exploitable remotely over the network, with no need for local or physical access.
  • Attack complexity: Low. No special conditions; the attack can be repeated reliably.
  • Privileges required: None. No account or prior access is needed.
  • User interaction: None. No action from any user is needed.
  • Scope: Changed. Impact reaches beyond the vulnerable component to other resources.
  • Confidentiality impact: Low. Some information is exposed.
  • Integrity impact: Low. Some data can be modified.
  • Availability impact: High. Total loss of availability; the component can be shut down.

Affected products

  • Oracle Weblogic Server: 10.3.6.0.0; 12.1.3.0.0; 12.2.1.1.0; 12.2.1.2.0; 12.2.1.3.0

References