The version of Oracle WebLogic Server installed on the remote host is affected by multiple vulnerabilities :

  - A flaw exists in Jython due to executable classes being     created with insecure permissions. A local attacker can     exploit this to bypass intended access restrictions and     thereby disclose sensitive information or gain elevated     privileges. (CVE-2013-2027)

  - A remote code execution vulnerability exists in the     Apache Struts component in the Jakarta Multipart parser     due to improper handling of the Content-Type,     Content-Disposition, and Content-Length headers.
    An unauthenticated, remote attacker can exploit this,     via a specially crafted header value in the HTTP     request, to execute arbitrary code. (CVE-2017-5638)

  - An unspecified flaw exists in the Web Services component     that allows an unauthenticated, remote attacker to have     an impact on integrity and availability.
    (CVE-2017-10063)

  - An unspecified flaw exists in the Web Container     component that allows an authenticated, remote attacker     to disclose sensitive information. (CVE-2017-10123)

  - An unspecified flaw exists in the JNDI component that     allows an unauthenticated, remote attacker to execute     arbitrary code. (CVE-2017-10137)

  - An unspecified flaw exists in the Core Components that     allows an unauthenticated, remote attacker to cause a     denial of service condition. (CVE-2017-10147)

  - An unspecified flaw exists in the Core Components that     allows an unauthenticated, remote attacker to have an     impact on integrity. (CVE-2017-10148)

  - An unspecified flaw exists in the Web Container     component that allows an unauthenticated, remote     attacker to have an impact on confidentiality and     integrity. (CVE-2017-10178)

Detections

Analytics

Oracle WebLogic Server Multiple Vulnerabilities (July 2017 CPU)

critical Nessus Plugin ID 101815

Version 1.14

Version 1.13

Version 1.12

Version 1.14 Jan 4, 2024, 3:23 PM Detection Plugin Feed: 202401041523
Version 1.13 Dec 12, 2023, 5:15 PM Detection Plugin Feed: 202312121715
Version 1.12 Apr 25, 2023, 11:11 PM CVSS temporal metrics (Adjust exploitability metrics for CISA KEV vulnerabilities) Plugin Feed: 202304252311