CVE-2015-4852 The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to execute arbitrary commands via a crafted serialized Java object in T3 protoco...
CriticalCVSS 9.8
EPSS 95.0%
CISA KEV
added 2021-11-03 · due 2022-05-03
Exploited in the wild
Framework module
Public exploit
PoC
- Published
- Updated
- Exploit status
- Exploited in the wild (confirmed)
Description
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to execute arbitrary commands via a crafted serialized Java object in T3 protocol traffic to TCP port 7001, related to oracle_common/modules/com.bea.core.apache.commons.collections.jar. NOTE: the scope of this CVE is limited to the WebLogic Server product.
CISA Known Exploited Vulnerability
- Date added
- 2021-11-03
- Due date (FCEB)
- 2022-05-03
- Ransomware use
- Unknown
Required action
Apply updates per vendor instructions.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| oracle virtual desktop infrastructure | <= 3.5.2 | No fix listed |
| oracle storagetek tape analytics sw tool | = 2.3 | No fix listed |
| oracle weblogic server | = 10.3.6.0.0 | No fix listed |
| oracle weblogic server | = 12.1.2.0.0 | No fix listed |
| oracle weblogic server | = 12.1.3.0.0 | No fix listed |
| oracle weblogic server | = 12.2.1.0.0 | No fix listed |
| ubuntu/openjdk-8(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/openjdk-8(Ubuntu:22.04) | All versions | No fix listed |
References
- Ubuntu CVE tracker vendor-advisory
- USN-6936-1 vendor-advisory
- www.cve.org
- foxglovesecurity.com exploit
- packetstormsecurity.com exploit third-party-advisory vdb-entry
- [oss-security] 20151117 Re: Assign CVE for common-collections remote code execution on deserialisation flaw mailing-list third-party-advisory
- www.oracle.com patch
- www.oracle.com patch vendor-advisory
- www.oracle.com patch vendor-advisory
- www.oracle.com patch vendor-advisory
- www.oracle.com vendor-advisory
- www.oracle.com patch vendor-advisory
- 77539 broken-link vdb-entry
- 1038292 broken-link vdb-entry
- blogs.oracle.com broken-link
- github.com product
- 42806 exploit third-party-advisory vdb-entry
- 46628 exploit third-party-advisory vdb-entry
- www.cisa.gov government-resource us-government-resource