CVE-2017-10352
CriticalSummary
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware allows an unauthenticated attacker with network access via HTTP to compromise the server. The attacker can cause hangs or frequent crashes of the server and gain unauthorized access to data.
Risk Assessment
The risk to the organization includes the potential for complete server downtime and unauthorized access to data, which can lead to serious consequences for the integrity and availability of the system.
Recommendation
It is recommended to update to the latest version of Oracle WebLogic Server and implement appropriate security measures to restrict server access to authorized users.
Original NVD description (English source)
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS - Web Services). The supported version that is affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0, 12.2.1.2.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. While the vulnerability is in Oracle WebLogic Server, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle WebLogic Server as well as unauthorized update, insert or delete access to some of Oracle WebLogic Server accessible data and unauthorized read access to a subset of Oracle WebLogic Server accessible data. CVSS 3.0 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H).