CVE-2023-40571
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk64th percentile - higher than 64% of all known CVEs
Summary
In versions 0.2.3 and prior, the weblogic-framework tool does not verify returned data packets, leading to a deserialization vulnerability. This may result in remote code execution when the tool deserializes data returned by the server without verification.
Risk Assessment
Organizations may be exposed to remote code execution, potentially leading to serious security breaches and data loss.
Recommendation
It is recommended to upgrade to version 0.2.4, which includes a patch addressing this vulnerability.
Original NVD description (English source)
weblogic-framework is a tool for detecting weblogic vulnerabilities. Versions 0.2.3 and prior do not verify the returned data packets, and there is a deserialization vulnerability which may lead to remote code execution. When weblogic-framework gets the command echo, it directly deserializes the data returned by the server without verifying it. At the same time, the classloader loads a lot of deserialization calls. In this case, the malicious serialized data returned by the server will cause remote code execution. Version 0.2.4 contains a patch for this issue.