Description
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.2 and 12.2.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Oracle | WebLogic Server | 10.3.6.0, 12.1.3.0, 12.2.1.2, 12.2.1.3 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
Oracle Weblogic Server Deserialization RCE
exploit/multi/misc/weblogic_deserialize
Exploit-DB 3
- Oracle Weblogic Server - Deserialization Remote Command Execution (Patch Bypass) EDB-46513 · remote · Oct 25, 2018
- Oracle Weblogic Server - Deserialization Remote Code Execution (Metasploit) EDB-45193 · remote · Aug 13, 2018 · verified
- Oracle Weblogic Server 10.3.6.0 / 12.1.3.0 / 12.2.1.2 / 12.2.1.3 - Deserialization Remote Command Execution EDB-44553 · remote · Apr 22, 2018 · verified
GitHub 21 repositories · most starred shown
-
daybreak-kits/weblogicScanner ★ 2,079 · Jan 15, 2020
weblogic 漏洞扫描工具。目前包含对以下漏洞的检测能力：CVE-2014-4210、CVE-2016-0638、CVE-2016-3510、CVE-2017-3248、CVE-2017-3506、CVE-2017-10271、CVE-2018-2628、CVE-2018-2893、CVE-2018-2894、CVE-2018-3191、CVE-2018-3245、CVE-2018-3252…
-
tdy218/ysoserial-cve-2018-2628 ★ 114 · May 3, 2018
Some codes for bypassing Oracle WebLogic CVE-2018-2628 patch
-
jas502n/CVE-2018-2628 ★ 107 · Jun 5, 2018
Weblogic 反序列化漏洞(CVE-2018-2628)
-
shengqi158/CVE-2018-2628 ★ 78 · Apr 18, 2018
CVE-2018-2628 & CVE-2018-2893
-
forlin/CVE-2018-2628 ★ 20 · Apr 18, 2018
CVE-2018-2628
-
aedoo/CVE-2018-2628-MultiThreading ★ 15 · Apr 18, 2018
WebLogic WLS核心组件反序列化漏洞多线程批量检测脚本 CVE-2018-2628-MultiThreading
-
jiansiting/weblogic-cve-2018-2628 ★ 14 · Apr 18, 2018
-
0xMJ/CVE-2018-2628 ★ 12 · Jan 7, 2019
漏洞利用工具
-
Lighird/CVE-2018-2628 ★ 10 · Oct 30, 2018
CVE-2018-2628漏洞工具包
-
Nervous/WebLogic-RCE-exploit ★ 5 · Sep 4, 2018
A remote code execution exploit for WebLogic based on CVE-2018-2628
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Oracle WebLogic Server Deserialization - Remote Code Execution network/cves/2018/CVE-2018-2628.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
References
- https://github.com/brianwrf/CVE-2018-2628
- 44553 exploit
- 103776 vdb-entry
- 1040696 vdb-entry
- 46513 exploit
- http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
- 45193 exploit