CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Showing 1โ1 of 1 advisories (Page 1/1)
2017-10-19
Oracle WebLogic Server WLS Security XML Deserialization Remote Code Execution (RCE) Vulnerability (CVE-2017-10271) Analysis and Mitigation Guide
[Affected Scope] Oracle WebLogic Server versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0, and 12.2.1.2.0
[Impact] Unauthenticated remote attackers can execute arbitrary system commands and fully compromise the WebLogic Server via crafted XML payloads sent over HTTP/T3
[Mitigation] Apply the official Oracle Critical Patch Update (CPU) or disable the vulnerable 'wls-wsat' component and restrict T3 protocol access