Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle WebLogic Server accessible data. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

The version of WebLogic Server installed on the remote host is affected by multiple vulnerabilities as referenced in the January 2018 CPU advisory, as follows:

  - Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS - Web     Services). The supported version that is affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0, 12.2.1.2.0 and     12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP     to compromise Oracle WebLogic Server. While the vulnerability is in Oracle WebLogic Server, attacks may     significantly impact additional products. Successful attacks of this vulnerability can result in     unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle WebLogic     Server as well as unauthorized update, insert or delete access to some of Oracle WebLogic Server     accessible data and unauthorized read access to a subset of Oracle WebLogic Server accessible data.
    (CVE-2017-10352)

  - Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web     Services). Supported versions that are affected are 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.2.0. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise     Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized read access to     a subset of Oracle WebLogic Server accessible data. (CVE-2018-2625)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version, the Oracle iPlanet Web Server (formerly known as Sun Java System Web Server) running on the remote host is 7.0.x prior to 7.0.27 Patch 26834070. It is, therefore, affected by an unspecified vulnerability in the Network Security Services (NSS) library with unknown impact.

The version of Oracle HTTP Server installed on the remote host is affected by multiple vulnerabilities as noted in the January 2018 CPU advisory.

ID	Name	Product	Family	Severity
144326	Oracle WebLogic Server Multiple Vulnerabilities (Jan 2018 CPU)	Nessus	Misc.	critical
106349	Oracle iPlanet Web Server 7.0.x < 7.0.27 NSS Unspecified Vulnerability (January 2018 CPU)	Nessus	Web Servers	critical
106299	Oracle Fusion Middleware Oracle HTTP Server Multiple Vulnerabilities (January 2018 CPU)	Nessus	Web Servers	critical

Detections

Analytics

CVE-2018-2625

medium

Tenable Plugins

critical

critical

critical