CVE-2017-10137
CriticalSummary
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware allows an unauthenticated attacker with network access via HTTP to compromise the server. Affected versions are 10.3.6.0 and 12.1.3.0.
Risk Assessment
An attacker can remotely take control of the Oracle WebLogic Server, which may significantly impact other products relying on this server.
Recommendation
It is recommended to update to the latest version of Oracle WebLogic Server to minimize the risk associated with this vulnerability.
Other vulnerabilities in Oracle WebLogic Server
See all- CVE-2017-10147High
A vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware allows an unauthenticated attacker with network access via T3 to compromise the server. Attacks may lead to hanging or frequent crashes of the server, resulting in a complete denial of service (DoS).
- CVE-2016-3505High
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0, 12.1.3.0, and 12.2.1.0 allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to JavaServer Faces.
- CVE-2016-0577High
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, 12.1.3, and 12.2.1 allows remote attackers to affect confidentiality, integrity, and availability.
- CVE-2016-0574High
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, 12.1.3, and 12.2.1 allows remote attackers to affect confidentiality, integrity, and availability.
- CVE-2016-0573High
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, 12.1.3, and 12.2.1 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to WLS Java Messaging Service.
- CVE-2016-0572High
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, 12.1.3, and 12.2.1 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Coherence Container.
- CVE-2014-2470High
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.0.2.0, 10.3.6.0, 12.1.1.0, and 12.1.2.0 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to WLS Security.
- CVE-2026-60977Critical
Vulnerability in Oracle WebLogic Server (component: WLS Core Components) affects versions 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. Easily exploitable flaw allows unauthenticated attacker with network access via RMI to compromise Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).
- CVE-2026-60702Critical
Vulnerability in Oracle WebLogic Server (component: Core) allows a low-privileged attacker via T3 or IIOP to completely take over the server. The attack may impact other products (scope change). CVSS score 9.9.
- CVE-2026-60698Critical
Vulnerability in Oracle WebLogic Server (component: Core) allows an unauthenticated attacker via IIOP to completely take over the server. CVSS score 9.8.
Original NVD description (English source)
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: JNDI). Supported versions that are affected are 10.3.6.0 and 12.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. While the vulnerability is in Oracle WebLogic Server, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).